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Preface 

Unmanned  aerial  vehicles  under  test  may  pose  unexpected  risks  to  personnel  and 
property  on  or  near  the  flight  test  range.  The  local  safety  decision  authority  must  ensure  that  risk 
is  managed  to  an  acceptable  level.  Mishap  taxonomy  is  useful  in  dividing  the  large  question:  “Is 
this  vehicle  safe  to  test  on  this  range?”  into  a  series  of  smaller,  more  manageable  questions.  This 
taxonomy  is  based  on  the  collected  mishaps  experienced  in  the  Department  of  Defense,  National 
Aeronautics  and  Space  Administration,  and  with  some  foreign  vehicles. 

The  Range  Safety  Group  developed  this  document  in  response  to  Range  Commanders 
Council  task  RS-60,  which  requested  a  taxonomy  structure  to  better  understand  types  of 
unmanned  aerial  vehicle  mishaps.  The  Atlantic  Test  Range  Range  Safety  Office  developed  this 
document  in  collaboration  with  the  NAVAIR  Unmanned  Aerial  System  Test  Directorate. 

Address  questions  about  this  document  to  either  the  Atlantic  Test  Range  Range  Safety 
Office  or  to  the  Range  Commanders  Council  Secretariat. 

Atlantic  Test  Range  Range  Safety  Office;  NAVAIR  5.2.2.G 

NAS  Patuxent  River,  Maryland 

Phone:  DSN  995-4636  Com  (301)  995-4636 

Fax:  DSN  342-1 190  Com  (301)  342-1190 

Email:  ATR  RANGE  SAFETY@navy.mil 

Secretariat,  Range  Commanders  Council 

ATTN:  TEDT-WS-RCC 

1510  Headquarters  Avenue 

White  Sands  Missile  Range,  NM  88002-5110 

Phone:  DSN  258-1107  Com  (575)  678-1107 

Fax:  DSN  258-7519  Com  (575)  678-7519 

Email:  usarmv.wsmr.atec.list.rcc@mail.mil 


IX 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 

This  page  intentionally  left  blank. 


x 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 


Acronym  List 


AGL 

above  ground  level 

ATC 

Air  Traffic  Control 

CFIT 

controlled  flight  into  terrain 

CRC 

control  and  reporting  center 

EP 

external  pilot 

FTS 

flight  termination  system 

GCS 

ground  control  station 

GPS 

Global  Positioning  System 

ICAO 

International  Civil  Aviation  Organization 

IMU 

inertial  measurement  unit 

INS 

inertial  navigation  system 

mlRC 

internet  relay  chat 

MSL 

mean  sea  level 

NM 

nautical  mile 

NATO 

North  Atlantic  Treaty  Organization 

NMAC 

near  midair  collision 

PIO 

pilot-induced  oscillation 

RATO 

rocket-assisted  takeoff 

RF 

radio  frequency 

RPM 

revolutions  per  minute 

RTB 

return  to  base 

TALS 

tactical  automatic  landing  system 

TCAS 

traffic  collision  avoidance  system 

UAV 

unmanned  aerial  vehicle 

xi 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 


This  page  intentionally  left  blank. 


xii 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 


CHAPTER  1 

Executive  Introduction 

There  are  known  knowns.  These  are  things  we  know  that  we  know.  There  are 
known  unknowns.  That  is  to  say,  there  are  things  that  we  know  we  don’t  know. 

But  there  are  also  unknown  unknowns.  There  are  things  we  don’t  know  we  don’t 
know.1 

Mishap  lessons  learned  are  valuable  tools  for  use  in  identifying  otherwise  unrecognized 
hazards  that  can  then  be  addressed  and  reduced  to  an  acceptable  level  of  risk.  Lessons  learned 
reduce  the  risk  of  exposure  to  “unknown  unknowns”  that  have  previously  been  encountered  by 
others. 


Unproven  unmanned  aerial  vehicles  (UAVs)  are  flown  on  Department  of  Defense  test 
and  training  ranges  to  establish  test  evidence  of  airworthiness  and  to  demonstrate  potential  for 
acquisition.  A  range  safety  risk  management  process  provides  the  test  team  with  an  assessment 
of  risk  to  local  personnel,  property,  and  range  operations  associated  with  the  proposed  test  of  the 
unproven  vehicle.  This  assessment  is  intended  to  allow  the  risk  decision  authority  to  make  an 
informed  decision  and  answer  the  question:  “Is  this  unproven  vehicle  safe  to  fly  on  this  range?” 

We  used  cluster  analysis  of  mishaps  to  develop  groups  that  can  be  defined  as  a  common 
hazard  scenario  describing  the  transition  from  normal  flight  to  loss  of  the  ability  to  maintain 
normal  controlled  flight. 

We  developed  a  taxonomy  of  hazard  scenarios  based  on  review  of  mishap  data  from  612 
UAV  mishaps.  The  major  categories  of  the  taxonomy,  each  used  as  a  chapter  in  this  document, 
were  based  on  vehicle  material  failures  (Chapter  2),  operator/vehicle  interaction  (Chapter  3), 
launchers  and  recovery  systems  (Chapter  4),  environment  (Chapter  5),  multiple  sources  of 
control  (Chapter  6),  and  the  airspace  system  (Chapter  7).  Each  scenario  was  further  categorized 
by  phase  of  flight  and  the  cause  or  event  leading  to  loss  of  flight-critical  capability. 

Appendix  A  describes  the  degraded  flight  situation  using  modified  International  Civil 
Aviation  Organization  (ICAO)  airline  mishap  terminology.  The  frequency  of  hazard  scenarios 
transitioning  to  specific  degraded  states  was  determined. 

This  document  provides  three  distinct  benefits  to  range  safety. 

1.  A  foundation  for  in-depth  risk  management 

The  mishap  taxonomy  is  a  means  for  defining  and  bounding  the  body  of  knowledge  to 
manage  UAV  flight  test  risk  to  personnel  and  property.  The  sum  of  unique  terms,  concepts,  and 
experiences  from  individual  mishap  scenarios  combine  as  the  foundation  for  effective  safety 
efforts.  Systematic  validation  and  amplification  of  the  taxonomy  by  subject  matter  experts  will 
further  increase  the  value  of  updates. 

2.  A  framework  for  consistent  Range  Safety  support 

The  mishap  taxonomy  provides  a  list  of  potential  hazard  scenarios  a  UAV  test  might 
encounter  during  test  and  operations.  A  mishap  history  can  provide  a  basis  for  estimating 


1  Secretary  of  Defense  Donald  Rumsfeld.  Department  of  Defense  News  Briefing.  12  February  2002. 
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probability  and  severity  of  a  list  of  hazard  scenarios  associated  with  a  specific  UAV.  Grouping 
hazard  scenarios  into  categories  helps  to  form  strategies  for  each  category.  These  broad 
strategies  may  then  address  similar  but  unanticipated  hazards. 

3.  A  basis  for  identifying  and  prioritizing  strategic  improvement  opportunities 

Mishap  taxonomy  and  corresponding  mishap  experience  allows  systematic  investigation 
and  search  for  unrecognized  risks  and  improvement  opportunities.  Identifying  and  prioritizing 
strategic  improvement  opportunities  allows  for  changes  in  policy,  procedures,  training, 
equipment,  and  facilities  to  be  implemented. 

The  study  is  categorized  by  breaking  the  mishap  data  into  broad,  general  groups  of 
common  mishap  causes.  Each  of  these  general  groups  is  then  further  divided  into  subgroups  that 
contain  mishaps  of  a  similar  nature,  i.e.,  those  that  experience  the  same  general  loss  of  function 
resulting  from  a  particular  cause  are  grouped  together  (see  Figure  1-1).  Figure  1-2  shows  the 
number  and  percentage  of  each  general  common-cause  mishap  group  in  the  data. 


Loss  of  Thrust 

Runway  Takeoff 

Launch 
-  Systems 

Weather 

GCS  Handoff 

Midair  Collision 

Loss  of  Control 

Catapult  Launch 

Recovery 
-  Systems 

RF  Environment 

Shadowing  GCS 

Fly-away 

In  Flight 

(unoommanded  flight) 

Loss  of  Lift 

Runway  Landing 

Airfield 

Terrain 

Multiple  vehicles 
-  with  single  GCS 

Loss  of  Structural 
Integrity 

Arrested  landing 

Independent  FTS 

Toxic 

-  Materials 

Shipboard  Recovery 

Parachute  Landing 


I  [_  Ground  Ops 

Figure  1-1.  Taxonomy  Arrangement  by  Category 


NOTE  /% 

Some  mishap  events  listed  below  have  multiple  or 

Jr 

overlapping  causal  factors  and  may  be  listed  in  multiple 

r 

areas.  Some  mishap  events  are  not  detailed  in  the  text 

due  to  lack  of  investigation  details  or  redundancy. 
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UAV  Mishap  Categories 

Vehicle  material  failures  56% 

Operator/Vehicle  Interaction  25% 

Environment  8% 

Launch  and  Recovery  Systems  5% 

Airspace  3% 

Multiple  Sources  of  Control  3% 

0  50  100  150  200  250  300  350  400 

Total  mishaps  for  each  category 

Figure  1-2.  Distribution  of  Reviewed  Mishaps  by  Category 
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CHAPTER  2 

Vehicle  Material  Failures 

Sustained  flight  is  only  possible  when  the  structure  of  the  aircraft  is  intact  and  the 
forces  of  lift,  thrust,  and  control  are  sufficient  to  maintain  the  desired  altitude, 
speed,  and  attitude.  Consequently,  the  essential  functions  of  flight  are  structural 
integrity,  and  lift,  thrust,  and  control.2 

One  model  used  by  the  Aircraft  Combat  Survivability  community  is  based  on  lessons 
learned  from  combat  losses.  The  model  categorizes  these  losses  in  terms  of  which  flight- 
essential  function  was  lost.  Addressing  the  survivability  problem  (i.e.,  aircraft  vulnerability)  as  a 
series  of  smaller  problems  based  on  specific  flight-essential  deficiencies  allows  incremental 
improvements  resulting  in  improved  survivability.  This  same  approach  can  be  used  to  address 
mishap  lessons  learned  where  material  failures  were  a  significant  causal  factor.  Figure  2-1 
shows  the  breakdown  of  vehicle  material  failures  based  on  a  loss  of  a  flight-critical  function  and 
Figure  2-2  shows  the  distribution  of  mishaps  based  on  these  failures. 


2  Robert  E.  Ball.  The  Fundamentals  of  Aircraft  Combat  Survivability  Analysis  and  Design,  Second  Edition.  Reston: 
American  Institute  of  Aeronautics  and  Astronautics,  2003. 
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related 

Figure  2-1 .  Taxonomy  of  Vehicle  Material  Failures 


Mishaps  caused  by  vehicle 
material  failure 

tlttt 

ETaxi 

L|  ■  Takeoff 

■  Flight 

H _ ■  Landing 

0  50  100  150  200  250 

Number  of  mishaps 

Figure  2-2.  Distribution  of  Material  Failure  Mishaps  by  Loss  of  Flight 

Critical  Function 


Loss  of  Thrust  54% 
Loss  of  Control  34% 
Structural  Integrity  8% 
Loss  of  Lift  4% 
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2.1  Loss  of  Thrust 

A  variety  of  subsystem  failures  can  result  in  loss  of  thrust,  which  relates  to  a  vehicle’s 
ability  to  maintain  desired  altitude  and  climb  rate  and  to  remain  in  aerodynamic  control.  Figure 
2-3  shows  the  number  and  percentage  of  mishaps  by  subsystem  failure  resulting  in  a  loss  of 
thrust  in  each  phase  of  flight.  (The  percentages  in  this  figure  are  rounded  to  the  nearest  whole 
number,  so  they  may  not  total  100%). 


Loss  of  thrust  material  failures 


Fuel  system  28% 
Internal  engine  17% 
Lubrication  15% 
Ignition  system  14% 
Propeller  system  11% 
Stuck  throttle  7% 
Engine  controller  5% 
Engine  coolant  2% 


0  10  20  30  40  50 


60 


■  Taxi 

■  Takeoff 

■  Flight 

■  Landing 


Figure  2-3.  Distribution  of  Loss  of  Thrust  Mishaps  by  Subsystem 


With  minor  exceptions,  outcomes  of  loss  of  thrust  mishap  scenarios  were  the  following. 

•  Controlled  ditch  in  an  unpopulated  area  or  at  sea 

o  Used  to  minimize  damage  with  hopes  of  vehicle  recovery 

•  Intentional  crash  in  unpopulated  area 

o  If  difficult  to  recover  by  friendly  forces,  used  to  make  debris/weapons  less  valuable  to 
adversary 

•  Uncontrolled  ditch 

•  Successful  parachute  recovery  with  minor  damage 

•  Unsuccessful  parachute  recovery 

•  Attempted  landing  on  runway  at  primary  airfield 
o  Impact  short  of  runway 

o  Runway  excursions 
o  Hard  landing 

•  Forced  landing  at  a  contingency  or  alternate  airfield 


NOTE 

Successful  landings  and  landings  with  only  minor 

r 

damage  are  not  categorized  as  mishaps  and  are  not 

included  in  the  data  used  for  this  report. 
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2.1.1  Internal  Engine  Components 

Scenario:  Failure  of  internal  engine  components  results  in  engine  failure  and  loss  of  thrust. 

There  were  30  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
failure  of  internal  engine  components,  affecting  three  different  types  of  vehicles. 

The  largest  group  of  internal  engine  component  failures  was  due  to  an  engine  bearing 
failure  that  caused  the  engine  to  seize.  The  next  largest  group  of  failures  was  internal  engine 
foreign  object  damage  due  to  loose  bolts  or  washers  and  related  to  unexpected  corrosion, 
vibration,  and/or  maintenance  procedures. 

•  Engine  bearing  failure 

•  Omissions  in  maintenance  publications 

•  Component  corrosion  from  dissimilar  metals 

•  Bolts  loosening  from  vibration 

•  Manufacturing  quality  assurance  deficiencies 

2.1.2  Ignition  System 

Scenario:  Failure  of  the  engine  ignition  results  in  reduced  engine  performance  or  engine  failure 
and  loss  of  thrust. 

There  were  25  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
ignition  system  failures,  affecting  two  different  types  of  vehicles. 

The  ignition  system  is  used  to  provide  and  time  the  spark  needed  for  engine  combustion. 
The  majority  of  ignition  system  failures  was  traced  to  the  magneto  and  were  primarily  attributed 
to  exposure  to  high  engine  temperature  or  loose  wiring  connectors,  although  several  cases 
attributed  to  magneto  failures  were  reported  as  “unknown  causes.” 

•  Dirt  and  sand  on  the  spark  plug  gap  caused  pre-ignition,  damaging  the  engine. 

•  Sand  in  the  spark  plug  thread  exposed  a  spark  plug  to  combustion  temperatures,  causing 
the  spark  plug  to  melt. 

•  Fuel,  oil,  or  carbon  covering  the  spark  plug  firing  tip  results  in  a  fouled  spark  plug. 

2.1.3  Fubrication 

Scenario:  Foss  of  engine  lubrication  results  in  reduced  engine  performance  or  engine  failure  and 
loss  of  thrust. 

There  were  26  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
loss  of  engine  lubrication,  affecting  six  different  types  of  vehicles. 

Typical  lubrication-related  mishaps  involved  oil  starvation  (engine  no  longer  supplied 
with  lubricating  oil).  Oil  starvation  caused  engine  temperatures  to  rise  and  reduced  engine 
revolutions  per  minute  (RPM),  which  corresponded  to  either  reduced  thrust  or,  if  the  engine 
seized,  no  thrust. 

•  Failure  to  service  the  oil  system  before  flight 

•  Failure  to  check  the  oil  level  before  flight 
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•  Oil  leak  (loose  bolts,  oil  filter  or  oil  seal  failure) 

•  Oil  flow  blockage  (oil  filter  clogged,  thermo  control  valve  installed  incorrectly,  oil  return 
line  blocked) 

•  Scavenge  pump  failure 

•  Oil  pump  drive  belt  failure 

•  Oil  tube  to  engine  came  loose  during  pneumatic  launch 

•  Turbocharger  failure  due  to  oil  sump  line  capacity  inadequate  for  some  operating 
conditions  (e.g.,  high  gross  weight) 

Lubrication-related  damage  to  engines  was  experienced  on  some  vehicles  by  unfiltered 
air  mixing  with  oil  in  a  dust-filled  environment.  The  particles  in  the  oil  acted  like  liquid 
sandpaper,  damaging  the  moving  internal  engine  parts. 

2.1.4  Engine  Cooling  System 

Scenario:  Failure  of  the  engine  cooling  system  results  in  reduced  engine  performance  or  engine 
failure  and  loss  of  thrust. 

Four  mishaps  in  our  sample  can  be  characterized  as  loss  of  thrust  due  to  engine  failure 
from  overheating.  This  scenario  was  only  experienced  by  one  type  of  vehicle  using  a  unique 
independent  engine  cooling  system. 

2.1.5  Fuel  System 

Scenario:  Failure  of  fuel  system  components  results  in  loss  of  thrust. 

The  fuel  system  is  used  to  store  and  deliver  fuel  to  the  propulsion  system.  Failures  of  the 
fuel  system  have  resulted  in  reduced  thrust,  total  loss  of  thrust,  damage  to  the  engine,  and  engine 
fire. 

There  were  50  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
fuel  system  failure.  Most  of  the  fuel  system  failure-related  mishaps  (36  of  44)  were  specific  to 
one  type  of  vehicle. 

The  majority  of  fuel  system  failure  mishaps  can  be  characterized  as  fuel  starvation,  in 
which  sufficient  fuel  is  present  on  board  the  vehicle  but  does  not  reach  the  engine. 

•  Fuel  line  disconnected  or  separated 

•  Fuel  line  blocked  by  debris  or  air  bubble 

•  Fuel  pump  failure 

•  Fuel  filter  clogged  by  contaminated  fuel 

•  Difficult  to  assemble  connections 

•  Inadequate  guidance  in  maintenance  manuals 

•  Fuel  handling  procedures 

•  Bolts  that  had  worked  loose  over  time 

Fuel  exhaustion,  in  which  all  of  the  on-board  fuel  is  used  up,  was  also  a  key  scenario. 
Fuel  measuring  inaccuracies  were  a  significant  causal  factor. 

•  Fueling  method  introduces  errors 
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•  Inaccuracies  in  the  starting  quantity  of  fuel 

•  Fuel  remaining  is  calculated,  not  measured 

•  Erroneous  fuel  measurement  algorithm  (calculates  fuel  based  on  engine  RPM  and  throttle 
position,  not  taking  into  account  variations  of  individual  engines,  or  the  operating 
environment) 

Carburetors  ensure  the  correct  mixture  of  fuel  and  air  is  supplied  to  the  engine.  Failure 
of  the  carburetor  can  result  in  reduced  engine  RPM  and  loss  of  thrust. 

•  Flight  in  icing  conditions 

•  Failure  of  carburetor  deice 

•  Maintenance  assembly  errors 

Contaminated  fuel  degraded  engine  performance  in  several  instances.  Improved  fuel 
inspection  procedures,  filtering  from  the  fuel  supply  source,  aircraft  fuel  filters,  and  spark  plug 
cleaning  intervals  were  mentioned  in  reports  as  corrective  actions  for  these  scenarios. 

One  instance  of  fuel  nozzle  failure  in  a  turbine -powered  UAV  resulted  in  an  internal 
engine  fire. 

2.1.6  Throttle 

Scenario:  Failure  of  the  engine  throttle  control  results  in  uncontrollable  thrust  or  insufficient 
thrust  to  maintain  altitude. 

There  were  13  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  control 
due  to  throttle  failure,  affecting  three  different  types  of  vehicles. 

•  Failed  throttle  servo  (loose  connector,  mechanical  failure) 

•  Carburetor  butterfly  valve  stuck,  uncontrolled  RPM,  uncontrolled  climb,  then  idle 

•  Throttle  body  failed,  blocking  airflow,  resulting  in  low  manifold  pressure  (idle  RPM) 

2.1.7  Propeller 

Scenario:  Failure  of  the  propeller  structure,  drive  train,  or  propeller  feathering  function  results  in 
loss  of  thrust. 

There  were  20  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
failure  of  the  propeller,  drive  train,  or  propeller  feather  function,  affecting  four  different  types  of 
vehicles. 

There  were  eight  failures  in  which  variable -pitch  propellers  went  into  a  negative  pitch 
mode,  resulting  in  loss  of  thrust  and  high  drag. 

•  Failed  blade  shaft 

•  Failed  blade  pitch  servo 

•  Failed  blade  pitch  bearing 

•  Software  control  error  caused  negative  blade  pitch 
Other  propeller  failures: 
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•  Propeller  struck  pneumatic/rocket-assisted  takeoff  (RATO)  launcher  components. 

•  Failure  of  propeller  hub  retention  screws. 

•  Sheared  bolts  due  to  high  cycle  fatigue  or  excessive  wear. 

•  Propeller  disintegrated  on  takeoff  or  launch. 

•  Drive  shaft  sheared  on  an  experimental  vehicle. 

•  Propeller  broke  apart  after  hitting  improvised  chemlight  runway  lights  at  remote  site. 

•  Propeller  thrust  bearing  failed,  contaminating  the  engine  oil  lubrication  system,  causing 
engine  overheat  and  failure. 

•  The  propeller  went  into  BETA  (reverse)  mode  on  approach,  causing  excessive  sink  rate 
and  drag  that  the  pilot  did  not  recognize  until  it  was  too  low  to  recover.  The  UAV  hit 
power  lines. 

2.1.8  Engine  Controller 

Scenario:  Failure  of  the  engine  controller  results  in  reduced  engine  performance  or  engine 
failure,  uncontrolled  thrust,  or  lost  thrust. 

There  were  six  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  thrust  due  to 
failure  of  the  flight  control  computer,  affecting  four  different  types  of  vehicles. 

•  Loose  circuit  cards  or  connections. 

•  Electrical  short  in  control  cable. 

•  Failed  sensor  provided  erroneous  information. 

•  An  automatic  engine  cut  feature  based  on  wheels  touch-down  G-force  sensor  was 
activated  by  turbulence  on  final,  shutting  off  engine  prematurely. 

2.2  Loss  of  Control 

A  variety  of  subsystem  failures  can  result  in  loss  of  aerodynamic  control,  to  include 
heading  or  attitude  (pitch,  yaw,  roll)  control  and  navigation  position  information. 

Typical  outcomes  of  “loss  of  control”  mishap  scenarios  were: 

•  Undirected  flight  until  fuel  exhaustion  or  collision; 

•  Orbit  at  preprogrammed  rally  point  until  fuel  exhaustion; 

•  Entering  “safe”  mode,  such  as  automatic  shutoff  of  propulsion  and  deployment  of 
parachute; 

•  In-flight  breakup. 

Figure  2-4  shows  the  number  and  percentage  of  mishaps  by  system  failure  resulting  in  a 
loss  of  control  in  each  phase  of  flight. 


2-7 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 


Loss  of  control  material  failures 


Electrical  system  23% 
Flight  reference  system  20% 
RF  Control  link  19% 
Control  surface  17% 
Flight  control  system  13% 
Ground  control  station  6% 
Center  of  gravity  2% 

141  mishaps 


Number  of  mishaps 


■  Taxi 

■  Takeoff 

■  Flight 

■  Landing 


Figure  2-4.  Distribution  of  Loss  of  Control  Mishaps  by  Failed  System 


2.2.1  Radio  Frequency  Control  Link 

Scenario:  Loss  of  radio  frequency  (RF)  control  link  results  in  loss  of  operator  ability  to 
continuously  monitor  and  direct  vehicle  flight. 

There  were  27  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  control  due  to 
failure  of  the  RF  link,  affecting  seven  different  types  of  vehicles. 

•  Inability  to  regain  link  after  turning  link  off 

•  Flying  over  the  horizon  or  behind  high  terrain  or  obstruction 

•  Avionics  failure  due  to  rain/moisture  intrusion 

•  RF  interference  from  another  ground  station  or  UAV 

•  RF  connectors  vibrated  loose 

•  High  gain  satellite  antenna  unable  to  point  to  or  regain  satellite 

•  Software  prioritized  unusable  C-band  direct  link  over  satellite  link 

There  was  also  one  hazard  report  in  which  the  satellite  lost-link  emergency  mission 
caused  an  unexpected  climb  that  triggered  a  traffic  collision  avoidance  system  (TCAS)  alert  in 
another  aircraft. 


2.2.2  Control  Surface 

Scenario:  Failure  of  a  vehicle’s  aerodynamic  control  surface  to  function  results  in  reduced  or 
complete  loss  of  the  ability  to  maintain  controlled  flight. 

There  were  24  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  control  due  to 
failure  of  control  surface  components,  affecting  five  different  types  of  vehicles. 

•  Control  surface  servo  or  actuator  failure  (14  of  19  mishaps) 

•  Three  control  surface  linkage  failures  resulting  in  loss  of  or  insufficient  control  authority 

•  Control  surface  feedback  sensor  failure 

•  Stuck  control  surface 
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•  Encounter  with  lightning,  lost  aileron  control 

Scenario:  Failure  of  a  vehicle’s  ground  control  surface  results  in  its  inability  to  stop  or  maneuver 

on  the  runway. 

The  NASA  Wallops  facility  noted  they  have  had  experiences  with  locked  brakes,  failed 
brakes,  or  asymmetric  brakes. 

2.2.3  Electrical  System 

Scenario:  Failure  of  the  vehicle’s  electrical  system  results  in  loss  of  function  of  vehicle 

subsystems  and  loss  of  ability  to  continue  controlled  flight. 

There  were  32  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  control  due  to 
electrical  system  failure,  affecting  four  different  types  of  vehicles. 

•  Voltage  regulator  failure  resulting  in  short  circuit. 

•  Power  cable  chafing  resulting  in  short  to  ground. 

•  Voltage  spikes  from  generator  rebooted  computer  and  caused  lost  link. 

•  Single  generator  failure  induced  fault  in  remaining  generator. 

•  Electrical  system  control  module  failure. 

•  Inadequate  backup  battery  power. 

o  The  flight  controls  froze  on  approach  as  battery  power  ran  out. 

o  The  generator  had  insufficient  battery  power  to  operate  automatic  landing  system  or 
parachute. 

o  After  the  generator  had  tripped  offline  due  to  a  voltage  spike,  insufficient  battery 
voltage  to  reset  the  generator. 

o  The  controlling  ground  control  station  (GCS)  turned  off  non-essential  systems  to 
reduce  battery  load  after  generator  failure.  On  control  turnover  for  recovery,  initial 
settings  of  the  recovery  GCS  turned  vehicle  systems  back  on,  loading  the  battery,  and 
possibly  contributing  to  loss  of  control. 

o  Both  alternators  failed  and  the  operator  attempted  to  return  to  base  (RTB)  on  battery. 
The  UAV  operator  incorrectly  calculated  remaining  battery  life  and  did  not  reduce 
battery  load  sufficiently.  The  batteries  expired,  the  UAV  went  lost-link,  lost  control, 
and  crashed  one  half  mile  from  the  runway  threshold. 


2.2.4  Flight  Reference  System 

Scenario:  Failure  of  the  flight  reference  system  results  in  loss  of  attitude,  air  speed,  heading, 

position,  and/or  altitude  references.  This  causes  reduced  or  lost  ability  of  the  operator  or 
autopilot  to  maintain  controlled  flight. 

There  were  28  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  flight  reference 
data,  affecting  nine  different  types  of  vehicles. 

Foss  of  airspeed  reference 

Two  mishaps  were  related  to  airspeed  system  failure.  After  launch,  one  vehicle  showed 
oscillating  indicated  airspeed  and  porpoising  pitch  attitude.  The  vehicle  quickly  stalled  and 
crashed.  The  cause  was  determined  to  be  bird  strike  damage  that  caused  a  pitot  tube  blockage. 
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In  a  second  case,  again  after  launch,  the  vehicle  pitched  down  and  impacted  the  ground.  A 
blocked  pitot  tube  was  again  suspected. 

Loss  of  altitude  reference 

In  one  mishap,  failure  of  the  altimeter  pressure  transducer  or  related  hardware  caused 
erroneous  altitude  input  prior  to  catapult  launch.  The  erroneous  altitude  resulted  in  the  vehicle  to 
be  auto-launched  in  “constant  airspeed”  mode  rather  than  “constant  pitch  climb”  mode.  The 
vehicle  did  not  climb,  and  impacted  the  ground. 

In  another  mishap,  inaccuracies  in  the  inertial  navigation  system  (INS)/Global 
Positioning  System  (GPS)  navigation  system  resulted  in  a  glide  path  400  feet  below  the  intended 
glideslope.  Clouds  obscured  the  view  of  the  surface  and  the  vehicle  impacted  the  ground  on 
approach  to  the  runway. 

Loss  of  attitude  reference 

Failure  of  the  attitude  reference  source  was  a  factor  in  10  mishaps  in  four  different  types 
of  UAVs.  Typical  outcome  was  pitch  oscillations  followed  by  departure  from  controlled  flight 
characterized  by  stall,  rapid  descent,  and/or  in-flight  breakup.  In  one  case,  in  a  newly 
operational  type  vehicle,  an  external  pilot  (EP)  was  able  take  over  manual  control,  but 
emergency  landing  procedures  for  this  failure  had  not  yet  been  provided,  and  the  vehicle  was 
damaged  on  landing.  In  another  case,  the  vehicle  descended  behind  a  ridge  so  the  control  link 
was  lost  and  the  pilot  was  no  longer  able  to  update  emergency  procedures. 

Loss  of  heading  reference 

There  were  three  mishaps  on  two  different  types  of  vehicles  related  to  loss  of  heading 
reference.  Two  involved  a  failed  magnetometer  and  one  pointed  to  a  wiring  failure  from  the 
magnetometer.  In  one  case  the  failure  induced  an  un-commanded  turn.  During  the  emergency 
recovery  attempt,  control  was  lost  on  final  approach  and  the  vehicle  crashed.  Two  mishaps 
resulted  in  a  sudden  uncontrolled  rapid  descent  and  crash.  In  one  of  these  two  events,  replay 
showed  that  a  “magnetometer  fail”  indicator  had  been  on  for  16  minutes  prior  to  loss  of  control. 

Loss  of  navigation  information 

Six  mishaps  (one  fatal)  on  four  different  type  vehicles  were  related  to  loss  of  navigation 
position  information. 

Two  failures  were  due  to  crew  preflight  errors.  In  both  cases,  the  crew  failed  to  initialize 
the  GPS  properly  by  allowing  sufficient  time  to  acquire  satellites.  For  both  vehicles,  flight  was 
erratic  and  the  vehicle  crashed  shortly  after  takeoff. 

In  one  mishap,  the  GPS  antenna  cable  detached  in  flight,  so  an  accurate  position  was  not 
provided  to  the  automatic  landing  system  and  the  vehicle  crashed  on  landing. 

In  another  incident,  the  GPS  component  or  cable  vibrated  loose  in  flight  resulting  in  loss 
of  position  information.  The  vehicle  was  successfully  recovered  with  minor  payload  damage 
using  emergency  procedures. 

One  vehicle  had  a  dual  navigation  system  failure,  and  encountered  a  previously 
undetected  software  flaw  that  prevented  it  from  using  inertial  measurement  unit  (IMU)  attitude 
and  heading.  The  vehicle  departed  controlled  flight  and  crashed. 
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According  to  news  reports,3  jamming  of  GPS  signals  by  North  Korea  may  have 
contributed  to  the  fatal  crash  of  a  Schiebel  S-100  Camcopter  UAV  near  Incheon,  South  Korea, 
on  May  10,  2012.  The  small  helicopter  crashed  into  its  ground  control  van,  killing  a  Schiebel 
engineer  and  injuring  the  two  remote  pilots,  both  Koreans.  The  jamming  started  on  April  28  and 
disrupted  passenger  flights  into  Seoul’s  two  airports,  Gimpo  and  Incheon.  South  Korean 
government  officials  told  local  media  that  the  jamming  originated  from  the  border  town  of 
Kaesong.  Schiebel  said  that  an  incorrect  response  by  the  operators  after  the  Camcopter  lost  its 
GPS  signal  is  what  led  to  the  crash  some  minutes  later.  The  UAV  is  equipped  with  multiple 
IMUs  for  backup,  the  company  noted.  The  recorders  on  board  the  UAV  and  in  the  ground 
station  were  burned  during  the  crash,  and  could  not  provide  any  explanatory  data. 

Loss  of  visual  reference 

Pilots  sometimes  use  the  targeting  video  camera  rather  than  a  fixed  camera  in  the  nose  for 
takeoff  or  landing.  If  the  targeting  camera  moves  unexpectedly  or  if  the  video  becomes 
unusable,  the  pilot  can  become  disoriented  and  fail  to  maneuver  correctly. 

In  one  instance,  the  targeting  camera  moved  during  takeoff  roll,  which  resulted  in  the 
pilot  inducing  a  left  yaw  and  hitting  an  obstacle  near  the  runway. 

Failure  of  ground  sensing  reference 

One  UAV  failed  to  sense  the  ground  and  attempted  to  go  to  next  airborne  waypoint 

2.2.5  Flight  Control  Computer 

Scenario:  Failure  of  the  flight  control  computer  results  in  reduced  or  lost  ability  of  the  operator 
or  autopilot  to  control  flight. 

There  were  19  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  control  due  to 
failure  of  the  flight  control  computer,  affecting  four  different  types  of  vehicles. 

•  Flight  control  computer  software  caused  uncommanded  control  deflections. 

•  Flight  control  computer  hardware  failure  caused  uncommanded  control  deflections. 

•  Flight  control  computer  failure  resulted  in  no  authority  of  control  surfaces. 

•  Incorrect  flight  control  logic  resulted  in  divergent  vehicle  stability  and  loss  of  control 

•  Automatic  G-force  landing  detection  engine  shutoff  was  triggered  while  in  flight  when 
the  vehicle  encountered  turbulence. 

2.2.6  Ground  Control  Station 

Scenario:  Failures  within  the  GCS  result  in  lost  or  degraded  operator  ability  to  continuously 
monitor  and  direct  vehicle  flight. 

There  were  eight  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  control  due  to 
failure  of  GCS,  affecting  five  different  types  of  vehicles. 

•  Loss  of  link  occurred  due  to  corrosion-induced  reduction  of  the  GCS  antenna. 


3  Pocock,  Chris.  “UAV  Crash  in  Korea  Linked  to  GPS  Jamming.”  AINOnline,  June  1,  2012.  Retrieved  13  October 
2015.  Available  at  http://www.ainonline.com/aviation-news/defense/2012-Q6-01/uav-crash-korea-linked-gps- 
iamming. 
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•  A  GCS  restart  while  the  vehicle  was  in  flight  reset  the  vehicle’s  parameters  to  an  unsafe 
state. 

•  A  second  GCS  signal  caused  interference  with  GCS  control  (see  Chapter  6). 

•  A  stuck  keyboard  in  GCS  caused  a  delay  in  critical  commands  to  the  vehicle. 

•  Frozen  software  in  the  GCS  control  rack  on  landing  caused  the  vehicle  to  go  to  high¬ 
speed  lost  link  and  run  off  runway. 

2.2.7  Center  of  Gravity 

Scenario:  The  motion  of  shifting  interior  cargo  or  swinging  cargo  slung  below  a  vehicle  causes 
the  vehicle  to  become  unstable  and  depart  controlled  flight.  Cargo  dynamics  shifts  the 
center  of  gravity  beyond  limits. 

•  There  was  one  mishap  in  our  sample  in  which  the  cargo  that  was  slung  below  a  vertical- 
flight  UAV  began  to  swing  in  the  wind.  The  swinging  cargo  caused  increasing  vehicle 
pitch  instability  and  the  vehicle  crashed. 

•  A  similar  hazardous  situation  developed  when  the  vehicle  operator  switched  back  and 
forth  between  manual  and  automatic  control  as  the  vehicle  was  hovering  in  preparation  to 
land  with  a  sling  load.  The  operator  noticed  the  cargo  swinging  and  switched  from 
manual  to  auto  mode  to  stop  the  swinging,  which  made  the  swinging  worse  until  the 
vehicle  lost  GPS,  went  into  lost  navigation  mode,  and  climbed  several  thousand  feet.  The 
climb  stabilized  the  swinging  and  the  UAV  returned  to  base. 

Scenario:  Asymmetric  loading  of  left  and  right  fuel  tanks  leads  to  loss  of  control. 

There  is  a  single  mishap  in  our  sample  in  which  a  small  UAV  with  a  fuel  tank  on  each 
wing  experienced  loss  of  control  when  only  one  fuel  tank  was  being  used  and  the  vehicle  became 
unbalanced.  The  operator  could  no  longer  control  the  roll  axis,  and  the  vehicle  departed 
controlled  flight  and  crashed.  Unauthorized  maintenance  procedures  caused  the  fuel  feed  and 
vent  lines  to  become  kinked. 

2.3  Loss  of  Lift 

Several  types  of  material  failures  can  result  in  loss  of  aerodynamic  lift,  which  relates  to  a 
vehicle’s  ability  to  maintain  altitude  or  control  its  climb  or  descent  rate.  Typical  outcomes  of 
loss  of  lift  mishap  scenarios  were: 

•  Hard  landing; 

•  In-flight  breakup; 

•  Crash. 

Figure  2-5  shows  the  number  and  percentage  of  mishaps  by  component  failure  resulting 
in  a  loss  of  lift  in  each  phase  of  flight. 
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Parachute  47% 

Wing  35% 

Unexpected  drag  12% 

Spoilers  &  flaps  6% 
17  mishaps 


Figure  2-5.  Distribution  of  Loss  of  Lift  Mishaps  by  Failed  Component 

2.3.1  Wing 

Scenario:  Failure  of  or  structural  damage  to  one  or  both  wings  results  in  loss  of  lift. 

There  were  six  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  lift  due  to 
failure  or  structural  damage  of  a  wing  or  wing  component,  affecting  five  different  types  of 
vehicles. 

•  Wing  or  wings  separate  from  vehicle 

o  Screws  loosened  due  to  vehicle  vibration  during  flight.  Insufficient  pre-inspection 
procedures 

o  Excessive  bank  angle,  coupled  with  manufacturing  defect  (wing  spar  failure  to  adhere 
to  skin  at  high  altitude)4 

•  Catastrophic  wing  failure  in  testing  of  new,  high- altitude,  long-endurance  design 

•  In-flight  break  up 

o  Exposure  to  turbulence  in  an  experimental  vehicle 
o  Attitude  gyro  failure  resulted  in  overstress  of  the  vehicle 

2.3.2  Lift  Control  Surface  (spoilers,  flaps,  etc.) 

Scenario:  Failure  of  a  lift  control  surface  causes  loss  of  the  ability  to  maintain  control  of  desired 
altitude  and  descent  rate.  Asymmetric  failure  of  lift  control  surfaces  causes  the  vehicle  to 
depart  controlled  flight. 

There  was  a  single  mishap  of  this  type  in  our  sample  that  can  be  characterized  as  loss  of 
lift  due  to  lift  control  surface.  Spoiler  flap  actuators  on  a  test  vehicle  failed  at  high  altitude  after 
a  sudden  encounter  with  turbulence.  The  vehicle  was  successfully  recovered  with  minor  damage 
in  an  engine-out  landing. 


Loss  of  lift 


■  Taxi 

■  Takeoff 

■  Flight 

■  Landing 


0  2  4  6  8  10 


4  Merlin,  Peter  W.  “Crash  Course:  Lessons  Learned  from  Accidents  with  Autonomous  and  Remotely  Piloted 
Aircraft.”  NASA,  20 13. 
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2.3.3  Parachute 

Scenario:  Parachute  failure  during  a  parachute  recovery  results  in  unretarded  ground  impact, 
causing  damage  to  or  loss  of  vehicle. 

There  were  eight  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  lift  due  to 
material  failure  of  the  recovery  parachute,  affecting  four  different  types  of  vehicles. 

•  Parachute  failed  to  deploy  during  landing  sequence. 

•  Parachute  partially  deploys  (suspected  misrigging). 

•  Uncommanded  parachute  deployment  becomes  tangled  in  the  propeller. 

•  Parachute  fails  to  deploy  when  commanded  after  generator  failure. 

•  During  high  altitude  test,  parachute  deployed  after  engine  failure,  but  tore  in  cold 
temperatures  at  altitude. 

•  Installation  of  cable  over  parachute  pack  prevents  flight  termination  system  (FTS)- 
commanded  parachute  deployment. 

•  Momentary  lost  link  causes  emergency  parachute  deployment  during  takeoff  roll  (not  a 
mishap,  but  illustrates  a  potential  mishap  causal  factor  if  it  had  occurred  in  another  phase 
of  flight). 


NOTE 


v 


Parachute-induced  structural  damage  to  vehicle  (as  opposed  to 
loss  of  lift)  is  discussed  in  Subsection  2.4.5.  Parachute  failures 
due  to  operator  procedure  error  are  discussed  in  Section  3.7. 


2.3.4  Unexpected  Drag  (airbag,  speed  brakes,  etc.) 

Scenario:  Unexpected  deployment  of  vehicle  drag  sources  results  in  loss  of  ability  to  maintain 
desired  altitude  or  climb  rate. 

Scenario  lessons  learned  are  based  on  two  mishaps  of  a  foreign  UAV.  The  vehicle’s 
airbags,  intended  to  minimize  ground  impact  damage  during  parachute  recovery,  deployed 
during  catapult  launch.  The  vehicles  failed  to  gain  altitude  and  impacted  the  ground  soon  after 
launch.  One  failure  was  thought  to  be  due  to  a  failed  airbag  control  box,  and  the  other  was 
related  to  sand  intrusion  into  the  airbag  control. 

2.4  Loss  of  Structural  Integrity 

Several  types  of  material  failures  can  result  in  loss  of  structural  integrity.  Typical 
outcomes  of  loss  of  structural  integrity  mishap  scenarios  were: 

•  Loss  of  thrust  outcomes  when  power  plant  structure  was  involved; 

•  Loss  of  control  outcomes  when  control  surfaces  were  involved; 

•  Loss  of  lift  outcomes  when  lifting  surfaces  or  parachute  were  involved; 

•  Runway  excursions  (i.e.,  rolls  off  the  paved  runway  surface). 

Figure  2-6  shows  the  number  and  percentage  of  mishaps  by  causal  factor  resulting  in  a 
loss  of  structural  integrity  in  each  phase  of  flight.  (The  percentages  in  this  figure  are  rounded  to 
the  nearest  whole  number,  so  they  may  not  total  100%). 
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Loss  of  structural  integrity 

Arresting  hook  21% 

Launcher  caused  18% 

Parachute  15% 

Landing  gear  15% 

Weather  9% 

Fire  9% 

Vibration  9% 

Weapons  launch  3% 

0  2  4  6  8 

Figure  2-6.  Distribution  of  Loss  of  Structural  Integrity  by  Cause 

2.4.1  Vibration 

Scenario:  Vehicle  vibration  causes  mechanical  components  to  gradually  loosen  until  critical 
components  come  loose. 

•  Attachment  bolts  come  loose: 

o  causing  transmission  failure; 
o  causing  fuel  tank  separation. 

•  Structural  screws  come  loose  over  the  course  of  several  flights,  causing  the  wing  to 
separate  from  the  vehicle  after  catapult  launch  (combination  of  vibration  and  launcher- 
induced  failure  resulting  in  loss  of  lift). 

2.4.2  Launcher-related  Structural  Failure 

Scenario:  Material  failure  of  the  vehicle  results  in  failed  launch  from  UAV  launcher. 

There  were  no  vehicle  failures  of  this  type  in  the  mishaps  we  examined,  although  nine 
were  attributed  to  the  launchers.  Upon  further  investigation,  launcher-related  failures  were  found 
to  be  either  material  failure  of  the  launchers  themselves  (see  Section  4.1)  or  operator  errors  in 
configuring  the  launcher  (see  Section  3.2). 

2.4.3  Landing  Gear 

Scenario:  Failure  of  the  landing  gear  or  related  components,  such  as  tires  or  wheels,  results  in 
loss  of  directional  control  during  ground  operations. 

There  were  five  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  structural 
integrity  due  to  failure  of  landing  gear  or  landing  gear  components,  affecting  four  different  types 
of  vehicles.  An  additional  event  was  related  to  a  sudden  stop  on  the  taxiway. 

•  Underinflated  tires 

•  Nose  servo  shaft  failure 


Taxi 

l  Takeoff 
Flight 
Landing 
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•  Wheel  failure 

•  Landing  gear  failure  to  deploy 

•  Tail  damage  due  to  the  vehicle’s  sudden  stop  and  backwards  tilt  on  an  inclined  taxiway 

In  one  instance,  runway  operations  at  an  airfield  were  halted  for  several  hours  due  to 
trunnion  bolt  damage  discovered  during  taxi.  This  incident  is  not  categorized  as  a  mishap; 
however,  hindrance  to  normal  runway  operations  is  an  undesirable  outcome. 


2.4.4  Arresting  hook 

Scenario:  Failure  of  the  arresting  hook,  or  “tailhook,”  to  function  correctly  or  deploy  during 
recovery  operations  results  in  failure  of  the  vehicle  to  remain  on  runway  after  landing. 


Seven  events  were  attributed  to  an  arresting  hook  failure;  however,  there  was  only  one 
event  in  which  the  tailhook  structure  failed  on  engagement  with  the  arresting  gear  cable.  The 
vehicle  rolled  off  the  end  of  the  runway  and  was  damaged. 


Other  mishaps  related  to  material  failures  of  the  arresting  gear  rather  than 
the  arresting  hook  are  covered  in  Section  42.  Operator  skill  in  engaging 
the  arresting  gear  with  the  arresting  hook,  rather  than  material  failures  of 
the  vehicle  itself,  are  discussed  in  Section  3.5. 


2.4.5  Parachute 


Scenario:  Recovery  parachute  deploys  and  tangles  with  the  vehicle  or  propeller,  causing 
structural  damage  to  the  propeller  or  vehicle. 


There  were  four  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  structural 
integrity  due  to  parachute  failure,  affecting  one  type  of  vehicle.  In  all  four  mishaps,  the 
parachute  deployed  and  caused  damage  to  the  vehicle  or  propeller. 


Parachute  failures  resulting  in  loss  of  lift  (as  opposed  to  structural  damage) 
are  discussed  in  Subsection  2.3.3.  Parachute  failures  due  to  operator 
procedure  error  are  discussed  in  Section  3.7. 


2.4.6  Fire 

Scenario:  Onboard  fire  causes  structural  failure. 

There  were  three  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  structural 
integrity  due  to  fire,  affecting  one  type  of  vehicle.  Both  instances  were  related  to  oil  leaks  that 
ignited.  In  both  cases,  the  fire  consumed  the  engine  compartment  and  eventually  caused  attached 
control  surfaces  to  separate,  resulting  in  departure  from  controlled  flight. 

2.4.7  Weather 

Scenario:  Weather  phenomena  cause  structural  damage  or  structural  failure. 

There  were  three  mishaps  in  our  sample  that  can  be  characterized  as  loss  of  structural 
integrity  due  to  weather,  affecting  two  different  types  of  vehicles. 
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•  Crosswind  gusts  exceeded  the  limits  of  the  inertial  measuring  unit,  causing  an  abrupt  yaw 
followed  by  a  structural  failure  of  the  tail  boom. 

•  Hail  conditions  resulted  in  leading  edge  structural  damage  and  engine  damage. 

Weather  as  a  more  general  cause  of  mishaps  (not  specifically  related  to  structural 
damage)  is  discussed  in  Section  5.1. 

2.4.8  Weapons  Launch 

Scenario:  Weapons  launch  causes  vehicle  structural  damage. 

There  was  one  mishap  in  our  sample  that  can  be  characterized  as  structural  damage 
caused  by  weapons  launch.  On  launch,  a  missile  did  not  immediately  release  from  the  UAV’s 
missile  rack,  causing  the  aircraft  to  yaw  and  roll,  then  depart  controlled  flight  and  crash. 

2.5  Toxic  Materials 

Scenario:  Toxic  materials  used  in  the  construction  of  the  vehicle  or  as  fuel  causes  harm  to 
personnel  or  property  after  a  crash. 

Hazardous  aerospace  materials  are  materials  and  systems  integrated  into  aerospace 
vehicles  that  can  present  a  potential  safety  and  health  hazard  to  personnel  responding  to  mishaps. 
These  materials  can  include:  composite  materials,  radioactive  materials,  metals,  and  protective 
coatings. 

At  a  crash  scene,  hazardous  materials  may  require  special  handling  or  disposal 
procedures. 

Although  there  were  no  mishaps  in  our  sample  in  which  toxic  materials  were  a  causal 
factor,  the  presence  of  toxic  materials  in  the  event  of  a  mishap  can  significantly  increase  the 
severity  of  the  mishap  by  causing  additional  injuries.  Prevention  measures  may  reduce  this 
severity. 
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CHAPTER  3 

Operator  and  Vehicle  Interaction 

Operator- vehicle  interaction  failures  can  result  in  a  variety  of  mishaps.  Recognizing  and 
categorizing  which  safety-critical  tasks  have  caused  problems  in  the  past  can  provide  a  basis  for 
risk  management  of  operator-task  mismatch  issues. 

Phase  of  flight  and  type  of  launch  or  recovery  are  major  categories  because  they  represent 
significantly  different  tasks  and  problems  for  the  operator  to  resolve,  different  configurations  of 
the  vehicle,  and  different  operating  environments. 

Aviation  tasks  have  frequently  been  categorized  using  the  terms  “aviate,”  “navigate,”  and 
“communicate”  -  especially  in  relation  to  prioritizing  responses  to  emergency  situations.  We 
will  use  these  same  categories  and  adapt  their  definitions5  as  follows. 

Aviate.  Control  the  vehicle’s  path. 

•  Maintain  altitude,  heading,  air  speed,  pitch,  roll,  vertical  velocity,  etc.,  within  safe  limits. 

•  Avoid  obstacles  in  vicinity  of  flight  path. 

•  Detect  and  avoid  other  aircraft. 

•  Perform  emergency  maneuvers,  waveoffs,  or  runway  aborts  as  necessary. 

Navigate.  Direct  the  vehicle  from  its  origin  to  its  destination;  awareness  of  aircraft  position  in 
relation  to  its  desired  trajectory. 

•  Plan/update  flight  plan  considering  mission,  environment,  resources,  and  vehicle  health. 

•  Global  awareness  of  the  environment  from  origin  to  destination,  as  well  as  contingency 
destinations  (routes,  special-use  airspace,  boundaries,  weather,  geographic  obstacles, 
etc.). 

•  Local  guidance  (e.g.,  to  the  next  waypoint), 
o  Current  position 

o  Runway  site  survey,  runway  selection  for  current  wind  conditions 

•  Make  performance  calculations  as  necessary, 
o  Takeoff  distance 

•  Plan/update  contingency  routes  for  emergencies  or  lost  link. 

Communicate.  Provide  data  and  requests;  receive  instructions  and  flight-related  information. 

•  Communicate  with  airspace  authority  (e.g.,  Air  Traffic  Control  [ATC]). 

•  Monitor  weather  information  for  route  and  destination. 

Manage  Systems.  Manage  the  resources  available. 

•  Update  vehicle  configuration  for  phase  of  flight. 

•  Monitor  vehicle  health  status. 

•  Monitor  fuel  quantity. 


5  Ververs,  Patricia. 


“Understanding  a  Pilot’s  Tasks.”  University  of  Illinois  Aviation  Research  Laboratory,  1997. 
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Figure  3-1  shows  the  breakdown  of  mishaps  related  to  vehicle-operator  interaction, 
grouped  into  safety-critical  aviation  tasks. 


Vehicle  Operator  Tasks 

i  —  i  '  ,  i  —  i 
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Figure  3-1.  Taxonomy  of  Operator  and  Vehicle  Interaction  Mishaps  by 

Operator  Task 


Once  an  operator  or  automation-controlled  task  is  identified  as  a  causal  factor  in  a 
mishap,  it  can  be  further  analyzed  in  order  to  discover  opportunities  to  avoid  such  mishaps  in  the 
future. 


Recognizing  that  a  mishap  related  to  this  task  has  happened  before  can  prompt  a  closer 
examination  of  a  new  and  similar  situation.  Then  more  in-depth  analysis  can  be  used  to  look  for 
preconditions,  supervisory  issues,  or  organizational  influences. 

Review  of  UAV  mishap  operating  tasks  can  also  be  used  to  examine  differences  in 
manned  and  unmanned  decision  capability,  such  as  diminished  “air  sense”  capability,  situational 
awareness,  and  feedback  latency. 

This  document  identifies  operator  or  automation  tasks  related  to  mishaps  and  leaves  in- 
depth  analysis  to  future  efforts. 

Figure  3-2  shows  by  task  category  and  pilot  safety-critical  aviation  task  the  number  and 
percentage  of  mishaps  related  to  operator-vehicle  interaction. 
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Operator  vehicle  interface  issues 


Number  of  mishaps 


Figure  3-2.  Distribution  of  Operator  and  Vehicle  Interaction  Mishaps  by 

Task  Category 


3.1  Runway  Takeoff 

Aviate  Tasks  -  Runway  Takeoff 

Scenario:  Operator-commanded  early  rotation  and/or  stall  causes  loss  of  lift. 

•  During  initial  flights  at  a  high-altitude  airfield,  the  EP  rotated  early  based  on  visual 
distance  estimate  rather  than  velocity  readout.  Performance  charts  were  inaccurate  for 
the  runway  altitude.  The  presence  of  far-end  rigged  arresting  gear  was  a  factor. 

•  The  EP  did  not  notice  a  wind  shift  and  attempted  takeoff  with  an  unexpected  tailwind, 
over-rotated,  and  stalled. 

•  An  unqualified  EP  stalled  the  vehicle  during  touch  and  go.  No  qualified  EP  was  with 
him  at  the  time. 

•  The  EP  over-controlled  the  vehicle  rotation  and  stalled.  The  roll  distance  had  been 
calculated  inaccurately,  and  the  EP  accepted  a  runway  with  tailwinds. 

Scenario:  An  operator  fails  to  avoid  obstacles,  maintain  centerline,  or  achieve  the  appropriate 
rate  of  climb  on  runway  takeoff,  causing  a  mishap. 

•  During  a  night  operation,  there  were  no  runway  centerline  lights  and  the  nose  navigation 
light  was  not  working.  As  a  result,  the  EP  did  not  recognize  the  vehicle  drifting  off 
centerline  until  it  was  too  late  to  avoid  colliding  with  an  obstacle  near  the  runway. 

•  A  trainee  EP  delayed  announcing  the  vehicle’s  failure  to  climb,  resulting  in  a  late  takeoff 
abort  attempt.  The  vehicle  hit  upslope  off  the  end  of  the  runway. 

•  A  trainee  EP  drifted  off  centerline  during  a  touch  and  go  and  overcorrected  the  heading, 
so  the  vehicle  propeller  hit  a  runway  light  by  the  side  of  the  runway. 
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Navigate  Tasks  -  Runway  Takeoff 

Scenario:  Navigate  task  deficiencies  cause  incorrect  operator  actions  during  runway  taxi/takeoff, 
resulting  in  damage  to  or  loss  of  vehicle. 

•  Takeoff  distance  calculated  incorrectly. 

•  Wrong  runway  selected  for  current  winds. 

•  Wrong  speed  set  in  autonomous  taxi  mission  plan  not  discovered  during  review  process; 
vehicle  taxied  off  runway  at  high  speed. 


Communicate  Tasks  -  Runway  Takeoff 

Scenario:  Non-standard  tower  terminology  causes  a  potentially  hazardous  departure. 

Three  mishap  or  hazard  events  relating  to  tower  unclear  use  of  terminology  or  tower 
situational  awareness  during  takeoff  were  found  in  our  data  set.  These  events  are  described  in 
Chapter  7. 

Manage  System  Tasks  -  Runway  Takeoff 

Scenario:  System  management  task  deficiencies  cause  incorrect  operator  actions  during  runway 
taxi/takeoff,  resulting  in  damage  to  or  loss  of  vehicle. 

•  An  operator  inadvertently  selected  autopilot  pre-programmed  mode  rather  than  cooling 
fan.  The  vehicle  attempted  to  go  to  an  airborne  waypoint,  ran  off  the  taxiway  surface, 
and  hit  a  runway  light  (also  relates  to  Section  7.1). 

•  An  operator  failed  to  turn  on  the  stability  augmentation  system  in  accordance  with  the 
checklist.  After  takeoff,  the  vehicle  experienced  pitch,  roll,  and  yaw  excursions,  then 
stalled  and  crashed. 

•  An  incorrect  mission  plan  was  loaded,  causing  the  vehicle  to  taxi  in  the  wrong  direction. 
The  chase  driver  aborted  taxi  with  no  damage  to  the  vehicle.  Multiple  cross  checks  had 
failed. 

•  In  two  similar  incidents,  incorrect  configuration  of  the  targeting  system  camera  on 
takeoff  resulted  in  pilot  loss  of  situational  awareness.  The  vehicle  entered  into  lost-link 
mode  and  struck  an  obstacle  near  the  edge  of  the  runway. 

3.2  Catapult  Launch 

This  section  refers  to  mishaps  related  to  failure  of  mechanical  or  pneumatic  launchers. 
There  were  no  mishaps  in  our  sample  caused  by  aviate,  navigate,  or  communicate  tasks,  but  there 
was  a  number  of  system  management  causal  factors. 

Manage  Systems  Tasks  -  Catapult  Launch 

Scenario:  A  crew  fails  to  ensure  the  vehicle  and/or  GCS  are  in  the  correct  configuration  prior  to 
catapult  launch. 

•  The  pre-launch  inspection  missed  a  loose  alternator  plug.  The  plug  detached  after  launch 
and  the  vehicle  lost  electrical  power  and  crashed. 

•  During  preflight,  GPS  was  in  “dead  reckoning”  mode  rather  than  satellite  navigation 
mode.  The  operator  under  instruction  launched  the  vehicle  without  an  instructor  present. 
The  vehicle  crashed  just  after  launch. 
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•  The  communications  link  modem  failed  on  preflight;  however,  the  operator  launched  the 
vehicle  anyway.  The  vehicle  lost  contact  after  launch  and  is  presumed  to  have  run  out  of 
fuel  and  crashed. 

•  The  GCS  transmitter  and  a  separate  transmitter  for  the  EP  were  unexpectedly  both 
transmitting  at  the  same  time  as  a  result  of  improper  preflight.  After  launch  and  under  EP 
control,  the  GCS  transmitter  prevented  the  EP  from  controlling  the  vehicle  and  it  crashed. 

•  The  vehicle  was  launched  in  manual  control  rather  than  automatic  launch  mode  due  to  a 
skipped  step  in  the  checklist.  The  vehicle  rolled  and  crashed  after  launch  as  the  operator 
expected  auto  control,  so  was  not  providing  manual  inputs.  There  was  a  total  of  three 
similar  mishap  events. 

Scenario:  A  crew  fails  to  ensure  the  launcher  (with  vehicle  loaded)  is  in  the  correct 
configuration  prior  to  catapult  launch. 

•  A  loose  tool  left  on  top  of  the  vehicle  struck  the  propeller  on  launch,  shattering  the 
propeller.  The  vehicle  performed  a  forced  landing  after  launch. 

•  The  crew  started  to  switch  launchers  during  preflight,  but  changed  their  minds  and 
launched  from  the  original  launcher.  They  did  not  restart  the  checklist,  and  tried  to 
launch  with  a  launch  pin  still  in  place.  The  vehicle  snagged  on  the  launch  pin  and  broke 
apart  as  it  was  launched. 

•  The  crew  skipped  a  checklist  step  and  failed  to  disconnect  an  external  power  cable  from 
the  aircraft.  The  cable  struck  the  propeller  on  launch,  destroying  the  propeller.  There 
were  two  similar  mishaps  of  this  type. 

•  A  tool  left  on  the  launcher  hit  and  destroyed  the  propeller  on  launch.  The  vehicle  crashed 
just  after  launch. 

•  The  vehicle  was  launched  with  solar  panels  still  attached  and  crashed  just  after  launch. 

Scenario:  A  crew  fails  to  ensure  preflight  and  run-up  checks  are  completed  before  launch. 

•  High  engine  temperature  was  noted  on  preflight;  however,  the  vehicle  was  launched  from 
the  catapult  anyway.  The  vehicle  was  unable  to  sustain  climb  out  and  crashed. 

•  The  crew  failed  to  verify  sufficient  RPM  for  launch.  The  vehicle  was  pneumatically 
launched  with  insufficient  engine  thrust  and  crashed.  This  was  found  to  be  a  checklist 
error.  There  were  two  mishaps  like  this  in  our  sample. 

•  There  were  three  instances  of  a  vehicle  being  pneumatically  launched  with  engine  at  idle 
in  which  the  vehicles  quickly  hit  the  ground.  Checklist  steps  were  missed  in  all  three 
instances.  Distraction  was  a  factor  in  two  of  the  mishaps.  A  challenge  and  response 
checklist  technique  was  suggested. 

3.3  In  Flight 

Aviate  Tasks  -  In  Flight 

Scenario:  A  vehicle  operator  fails  to  maintain  flight  within  a  safe  operating  envelope. 

There  were  three  mishaps  of  this  type  involving  three  different  types  of  UAV. 

•  Camera  position  off  centerline  caused  the  internal  pilot  to  misperceive  vehicle  heading 
and  attitude.  The  pilot  over-corrected  and  stalled  the  vehicle,  which  entered  into  a  spin. 
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Negative  transfer  (i.e.,  previous  manned  aircraft  experience)  may  have  been  a 
contributing  factor. 

•  The  pilot  improperly  controlled  the  speed,  causing  a  stall. 

•  A  foreign  UAV  “exceeded  operating  limits”  and  crashed.  No  additional  information  is 
available. 


Navigate  Tasks  -  In  Flight 

Scenario:  Inadequate  route  planning  leads  to  loss  of  aircraft. 

•  The  emergency  mission  plan  was  improperly  programmed;  the  vehicle  hit  terrain  when  it 
lost  link. 

•  A  vehicle  operator  attempted  to  find  a  route  between  thunderstorms.  The  vehicle  was 
lost  after  a  lightning  strike  and  apparent  encounter  with  icing  conditions  (this  mishap  is 
also  used  to  illustrate  thunderstorm  hazards  in  Subsection  5.1.1). 

•  After  on-station  mission  completion  and  RTB.  a  UAV  flew  through  snow,  ice,  and 
turbulence.  While  in  these  conditions,  the  UAV  encountered  five  severe  downdrafts  and 
went  lost  link.  The  review  board  determined  that  the  pilot  failed  to  assess  the  weather, 
and  that  lost  link  was  due  to  lightning  strike. 

Scenario:  Inadequate  calculation  of  the  remaining  battery  vs.  distance  to  base  results  in  loss  of 
the  aircraft. 

Both  alternators  in  the  UAV  failed  and  the  operator  attempted  to  RTB  on  battery  power; 
however,  the  operator  incorrectly  calculated  the  remaining  battery  life  and  did  not  reduce  battery 
load  sufficiently.  The  batteries  expired  and  the  UAV  went  lost  link,  lost  control,  and  crashed  one 
half  mile  from  the  runway  threshold  (see  also  Subsection  2.2.3). 

Communicate  Tasks  -  In  Flight 

Scenario:  Non-compliance  with  ATC  communications  causes  a  potentially  hazardous  airspace 
situation. 

There  were  five  mishap  or  hazard  events  in  our  data  sample  relating  to  in-flight 
communications  deficiencies.  These  events  included  two  non-compliance  events,  two  events  in 
which  instructions  were  not  understood,  and  one  instance  of  failure  to  maintain  communications. 
These  events  are  described  in  more  detail  in  Section  7J_  and  Section  7.2. 

Manage  System  Tasks  -  In  Flight 

Scenario:  An  incorrect  or  unauthorized  configuration  decision  by  operator  results  in  the  loss  of  a 
flight-critical  function  and  loss  or  damage  to  the  vehicle. 

•  A  UAV  had  experienced  an  uncommanded  engine  cut  during  preflight  but  was  launched 
anyway.  The  engine  failed  during  the  mission  and  the  vehicle  entered  an  uncontrolled 
glide  and  crashed. 

•  An  operator  used  an  unauthorized  local  procedure  to  adjust  pitot  heat,  but  inadvertently 
erased  vehicle  memory.  The  vehicle  went  into  lost-link  mode,  stalled  due  to  the 
erroneous  data  in  memory  present  files,  and  crashed. 

•  A  vehicle  operator  became  confused  by  pitch  trim  settings  being  engaged  or  disengaged 
depending  on  autopilot  mode  selection.  This  confusion  increased  when  pitch  attitude 
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caused  loss  of  link  and  the  vehicle  began  to  cycle  between  lost-link  and  link  engaged 
modes.  The  vehicle  went  through  several  more  pitch  excursions  and  crashed. 

•  The  GCS  experienced  a  rack  lockup,  requiring  a  reset.  The  crew  used  an  incorrect  restart 
procedure  that  reset  aircraft  parameters  and  resulted  in  permanent  loss  of  link.  The  crew 
did  not  have  the  most  recent  validated  GCS  rack  lockup  reset  checklist.  The  vehicle 
followed  its  emergency  route  for  several  cycles  and  eventually  crashed  (also  in  Section 
7T). 

•  The  operator  mistakenly  deactivated  the  stability  augmentation  system  while  the  UAV 
was  in  flight  and  then  did  not  notice  the  vehicle  roll,  causing  lost  link  and  departure  from 
controlled  flight.  The  UAV  crashed  in  a  remote  area. 

•  The  operator  inadvertently  turned  off  the  ignition  when  intending  to  raise  landing  gear  at 
low  altitude.  The  UAV  glided  to  a  landing  short  of  the  runway  and  damaged  the  vehicle 
when  it  hit  a  hole  in  the  runway  clear  zone. 

•  The  operator  attempted  to  troubleshoot  a  known  faulty  secondary  autopilot.  When  the 
operator  switched  to  the  bad  autopilot,  the  vehicle  pitched  down.  The  operator 
commanded  lost  link  but  the  faulty  autopilot  maintained  the  pitch  down  attitude  and  the 
vehicle  crashed. 

•  The  operator  inadvertently  activated  the  fuel  shutoff  valve  while  the  UAV  was  in  flight, 
causing  the  engine  to  quit.  The  operator  attempted  a  forced  landing;  however  the  vehicle 
was  destroyed  when  it  went  off  the  end  of  the  runway. 

•  The  operator  improperly  set  the  throttle  quadrant  settings  prior  to  launch.  The  pre-launch 
checklist,  which  should  have  caught  the  error,  was  not  used  correctly.  The  vehicle  stalled 
in  flight  as  a  result  of  the  unrecognized  reverse  thrust  condition  that  exists  when  the 
throttle  is  in  any  position  other  than  full  forward. 

3.4  Runway  Landing 

Aviate  Tasks  -  Runway  Landing 

Some  contributing  factors  unique  to  UAVs  were  mentioned  in  multiple  mishap  reports. 

•  Latency  of  commands  to  the  UAV  contributes  to  induced  oscillation. 

•  Limited  visual,  audio,  and  relative  motion  cues  affect  situational  awareness. 

•  There  is  no  immediate  touchdown  feedback  indication  to  the  pilot. 

Scenario:  An  operator  fails  to  maintain  a  stable  approach,  flares  high  or  has  a  high  sink  rate,  and 
impacts  on  the  nose  gear  or  in  a  crab,  with  one  or  more  bounces,  resulting  in  aircraft 
structural  damage,  runway  excursion,  or  runway  overrun. 

There  were  20  mishaps  affecting  two  different  type  vehicles  that  encountered  this 
situation.  Four  mishaps  involved  operators  under  instruction,  and  three  of  these  incidents  also 
involved  crosswinds  as  a  contributing  factor. 

Scenario:  Fast  approach  by  the  EP  results  in  runway  over-run. 

There  were  two  mishaps  on  the  same  type  of  vehicle.  In  a  third,  similar  mishap  in  a 
different  vehicle,  the  internal  operator  failed  to  recognize  the  throttle  stuck  high  (which  resulted 
in  a  high,  fast  approach)  and  was  unable  to  brake  before  running  off  the  end  of  the  runway. 
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Scenario:  A  low  approach  attempt  at  night  by  an  EP  touches  down  short  of  the  runway,  causing 
vehicle  damage. 

There  was  one  incident  of  this  scenario  in  our  data. 

Scenario:  A  high  sink  rate  during  training  results  in  a  hard  landing,  tail  strike,  or  impact  short  of 
the  runway. 

There  were  three  mishaps  with  two  different  types  of  vehicle  involved  with  this  scenario. 

Scenario:  An  operator  use  of  a  stabilized  camera  display  causes  confusion  on  approach, 
resulting  in  loss  of  control. 

There  were  three  events  in  which  the  operator  used  a  stabilized  camera  that  caused 
misperception  during  runway  approach  and  resulted  in  disorientation  and  abnormal  runway 
contact  or  pilot-induced  oscillation  (PIO). 

Scenario:  An  operator  fails  to  maintain  clearance  above  obstacles  on  approach  or  during  landing 
rollout. 

In  the  one  mishap  in  our  sample,  an  EP  misjudged  vehicle  altitude  and  collided  with  trees 
on  final  approach. 

Scenario:  An  operator  fails  to  fly  the  emergency  profile  correctly. 

•  A  UAV  experienced  a  slow  loss  of  coolant  resulting  in  high  engine  temperature  and 
engine  failure  during  approach  to  base.  The  crew  failed  to  perform  a  flameout  approach 
and  the  UAV  overflew  the  runway  and  impacted  the  ground  1/2  mile  from  the  runway 
threshold. 

•  A  UAV  in  flight  developed  a  coolant  leak  (coolant  pump  seal)  and  elected  to  RTB.  Due 
to  heavy  gross  weight,  the  operator  elected  to  perform  a  normal  approach  rather  than 
flameout  approach.  During  the  normal  approach,  the  engine  lost  thrust  and  the  pilot 
attempted  a  forced  landing  1.4  nautical  miles  (NM)  short  of  the  landing  threshold. 
According  to  the  review  board,  the  operator  failed  to  diagnose  the  severity  of  the  mishap 
engine’s  problem,  did  not  perform  required  critical  actions  associated  with  the  high 
descent  rate,  and  did  not  maintain  limits  for  a  forced  landing. 

•  The  propeller  went  into  BETA  (reverse)  mode  on  approach,  causing  an  excessive  sink 
rate  and  drag  that  the  operator  did  not  recognize  until  the  UAV  was  too  low  to  recover. 
The  UAV  hit  power  lines. 


Navigate  Tasks  -  Runway  Landing 

Failure  to  adequately  perform  navigation  tasks  contributed  to  runway  landing  mishaps  in 
nine  events  that  can  be  broken  down  into  three  scenarios. 

Scenario:  Vehicle  operators  fail  to  identify  obstacles  on  or  near  the  anticipated  approach  path 
and  runway. 

•  Trees  along  approach  path 

•  Trees  along  route  of  unauthorized  low  pass  demo 

•  An  unused  arresting  net  pole  near  the  approach  end  of  the  runway 

•  Another  aircraft  parked  near  the  approach  end  of  the  runway 

•  A  light  pole  at  an  improvised  landing  demonstration  site 
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Scenario:  A  vehicle  operator  does  not  enter  the  landing  site  altitude  correctly  for  automated 

landing.  The  vehicle  impacts  with  the  ground  (multiple  similar  occurrences  for  one  type 
of  vehicle). 

Scenario:  Vehicle  operators  use  incorrect  wind  data  in  approach  runway  selection,  which 
contributes  to  landing  mishap. 

•  The  crew  did  not  correctly  record  the  crosswind  component  for  landing  either  due  to 
incorrect  crosswind  component  chart  use  or  mishearing  the  tower  winds.  The  aircraft 
performed  a  landing  approach  with  out-of-limits  winds,  significantly  increasing  pilot 
workload. 

•  Two  different  sets  of  wind  measuring  equipment  showed  differing  winds.  The  tower 
used  winds  from  one  system  showing  winds  within  crosswind  limits.  The  other  system, 
used  by  the  local  weather  service,  showed  winds  out  of  limits.  The  aircrew  proceeded  on 
approach  using  tower  winds;  however,  actual  winds  were  out  of  limits.  Excess  crosswind 
contributed  to  the  landing  mishap. 

•  The  remote  site  tower  did  not  have  a  wind  speed  and  direction  indicator,  so  the  pilot 
relied  on  hour-old  wind  data.  Current  wind  conditions  gave  a  13-knot  tailwind,  which 
resulted  in  a  runway  overmn  and  collision  with  a  barrier  at  the  end  of  the  runway. 


Manage  System  Tasks  -  Runway  Landing 

Failure  to  manage  vehicle  system  configurations  adequately  during  landing  resulted  in 
five  mishap  incidents. 

•  A  pilot  inadvertently  introduced  left  aileron  trim  and  misperceived  a  crosswind.  The 
pilot  focused  on  the  crosswind  rather  than  the  more  critical  decreasing  airspeed  and 
increasing  sink  rate  on  final  approach. 

•  The  pilot  under  instruction  pushed  the  “autopilot  disconnect”  switch  rather  than  the 
“master  caution  acknowledge”  switch  next  to  it.  The  UAV  on  approach  departed 
controlled  flight  and  crashed  into  the  trees. 

•  The  pilot  attempted  an  approach  while  in  cruise  mode,  which  causes  the  vehicle  to  try  to 
maintain  constant  airspeed.  The  vehicle  did  not  respond  to  manual  control  inputs  on 
approach  as  the  pilot  expected.  The  pilot  was  confused  and  the  vehicle  crashed  short  of 
the  runway. 

•  The  pilot  flew  a  slightly  fast  approach  on  final,  just  above  the  threshold  where  cruise 
mode  automatically  turns  on  and  retracts  flaps.  The  pilot  reduced  throttle,  decreasing 
airspeed,  and  the  vehicle  left  cruise  mode,  which  caused  the  flaps  to  return  to  normal, 
reducing  airspeed  even  more  (not  noticed  by  the  pilot,  who  was  focused  on  lining  up  on 
the  runway).  The  airspeed  continued  to  decrease  until  the  vehicle  stalled  and  impacted 
the  side  of  the  runway. 

•  Engine  cut  logic  causes  the  engine  to  shut  off  if  it  detects  a  landing  impact  (i.e.,  sudden  G 
force  change  at  low  altitude).  A  sudden  wind  shift  on  final  approach  caused  the  engine 
cut  logic  to  trigger,  resulting  in  a  hard  landing. 


3-9 


Unmanned  Aerial  Vehicle  Mishap  Taxonomy  for  Range  Safety  Reviews,  RCC  326-16,  February  2016 


3.5  Arrested  Runway  Landing 

Aviate  Tasks  -  Arrested  Runway  Landing 

Scenario:  A  pilot  (or  automatic  landing  system)  does  not  fly  the  vehicle  to  intercept  the  center  of 
the  arresting  cable. 

There  were  six  mishaps  that  affected  two  different  type  vehicles. 

•  The  vehicle  did  not  maintain  centerline  and  struck  an  object  on  the  side  of  the  runway 
before  the  arresting  gear. 

•  The  EP  performed  a  fast  approach  due  to  perceived  engine  problems.  The  vehicle 
bounced,  then  rolled  over  the  arresting  gear  at  the  edge  of  the  runway  where  the  cable 
had  been  previously  repaired  with  a  section  of  nylon  cable  that  lay  flat,  not  allowing  the 
hook  to  catch.  The  vehicle  continued  past  the  runway  end  into  the  over-run  area. 

•  The  EP  flew  a  slightly  fast  approach.  In  the  rollout  after  touchdown  and  engine  cut,  the 
vehicle  became  airborne  and  overflew  the  arresting  cable  and  overran  the  runway. 

•  A  vehicle  flew  over  the  arresting  gear  and  impacted  a  fence  at  the  end  of  the  runway. 

•  A  vehicle  flew  over  the  arresting  gear  and  past  the  runway  safety  net  and  landed  in  a 
ditch  past  the  runway. 

•  A  vehicle  under  control  of  an  EP  at  night  struck  a  pole  along  the  side  of  the  runway. 


Navigate  Tasks  -  Arrested  Runway  Landing 

Scenario:  The  aircrew  and/or  test  team  fails  to  perform  an  adequate  site  survey  for  arrested 
landings. 

There  were  two  mishaps  related  to  this  hazard  that  affected  two  different  vehicles. 

•  A  prototype  vehicle  was  being  tested  at  a  rocky,  remote  airfield.  The  vehicle  tailhook 
bounced  on  the  irregular  stone  surface  and  bounced  over  the  arresting  cable.  The  vehicle 
was  damaged  after  the  operator  made  a  sudden  turn  to  prevent  it  from  leaving  the  side  of 
the  runway.  Latency  was  determined  to  be  an  issue. 

•  A  taxiway  was  used  for  arrested  UAV  landings.  On  landing,  the  vehicle  tailhook 
bounced  over  the  taxiway  centerline  reflectors  and  missed  the  cable,  so  the  vehicle  rolled 
past  the  end  of  the  runway. 

3.6  Shipboard  Landing 

Aviate  Tasks  -  Shipboard  Landing 

Scenario:  An  EP  does  not  direct  the  vehicle  to  the  center  of  the  recovery  net  within  limits. 

Seven  mishaps  of  this  type  occurred  with  the  same  type  of  vehicle. 

•  The  pilot  over-adjusted  the  vehicle’s  approach  heading  and  the  vehicle  bounced  off  the 
edge  of  the  recovery  net  and  into  the  sea. 

•  A  pilot  under  instruction  flew  an  approach  with  wind  near  the  maximum  allowable  limit. 
The  ship  entered  a  Dutch  roll  as  the  vehicle  approached  the  net.  The  vehicle  hit  the  side 
of  the  net  and  a  support  pole,  and  then  fell  into  the  sea.  Wind  limits  were  reduced  after 
this  mishap.  There  were  two  other  similar  mishaps. 
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•  A  pilot  under  instruction  flew  a  series  of  approaches  at  night.  The  final  approach  attempt 
was  well  left  of  centerline.  The  pilot  under  instruction  used  a  hard  turn  to  return  to 
centerline,  but  the  vehicle  lost  attitude  and  slid  under  the  net,  damaging  the  aircraft.  The 
pilot  did  not  attempt  to  wave  off.  The  mishap  was  attributed  to  inexperience  and 
inadequate  training  in  night  visual  illusions  or  waveoff  guidance.  There  were  two  other 
similar  mishaps  involving  inexperience  and  night  operations.  In  one  case,  pilot  eyesight 
limitations  were  a  contributing  factor. 

3.7  Parachute  Recovery 

Aviate  Tasks  -  Parachute  Recovery 

Scenario:  A  UAV  operator  delays  activation  of  the  emergency/recovery  parachute,  resulting  in 
damage  to  or  loss  of  vehicle. 

Delays  in  deploying  a  parachute  may  result  in: 

•  Vehicle  altitude  too  low  for  parachute  to  fully  deploy  before  impact; 

•  Vehicle  descending  behind  terrain  and  option  to  deploy  parachute  is  lost; 

•  Operator  losing  option  to  deploy  parachute  when  emergency  battery  voltage  drops  below 
threshold  to  maintain  RF  link  or  activate  parachute. 

Parachute  material  failures  are  discussed  in  Subsection  2.3.3  and  Subsection  2.4.5. 

•  The  UAV’s  autopilot  failed  and  the  vehicle  went  into  a  dive.  The  aircrew  delayed 
deploying  the  emergency  parachute  and  the  vehicle  impacted  the  ground.  An  intermittent 
link  due  to  line-of-sight  issues  may  have  been  a  factor  in  the  delay. 

•  The  vehicle  reported  unusual  attitudes  prior  to  loss  of  control.  The  crew  did  not  deploy 
the  parachute. 

•  During  a  generator  failure  emergency,  the  vehicle  was  operating  on  battery  power  and  the 
crew  was  attempting  to  make  an  emergency  landing.  After  a  second  attempted  landing, 
the  battery  voltage  dropped  below  the  threshold  necessary  to  deploy  the  parachute.  The 
vehicle  lost  link  and  crashed. 

•  A  UAV  operator  activated  the  parachute  at  the  correct  time;  however,  the  battery  voltage 
dropped  below  the  level  necessary  to  deploy  the  parachute.  The  parachute  did  eventually 
open,  but  at  too  low  an  altitude  to  prevent  damage  to  the  vehicle. 

3.8  Ground  Operations/Taxi 

Fourteen  hazardous  ground  events  and  mishaps  relating  to  operator  errors,  route 
planning,  communication  errors,  switch  selection,  situational  awareness  deficiencies,  and  ground 
vehicle  incursions  were  found  in  this  data  set.  These  events  are  described  further  in  sections  7.4, 
7.5,  and  7.6. 
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CHAPTER  4 

Launch  Systems,  Recovery  Systems,  and  Airfield 

Some  UAV  mishaps  were  due  to  failures  of  launch  or  recovery  equipment  or  the  airfield 
environment  itself  (e.g.,  obstacles  in  the  flight  path,  the  quality  of  the  runway  surface,  etc.),  as 
shown  in  Figure  4-1.  Figure  4-2  shows  the  number  and  percentage  of  mishaps  by  airfield 
scenario. 
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Figure  4-1.  Taxonomy  of  Launch  Systems,  Recovery  System,  and 
Airfield-Related  Mishaps 
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Figure  4-2.  Distribution  of  Launch  System,  Recovery  System,  and 

Airfield  Mishaps 
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4.1  Launch  Systems 

“The  flight  was  uneventful  until  launch.  ”  -  A  comment  from  a  mishap  report  narrative 

Scenario:  A  launcher  fails  to  provide  sufficient  thrust  assistance  for  the  vehicle  to  become 
airborne. 

Four  mishaps  of  this  type  occurred  due  to  mechanical  failure,  failure  of  the  control  box 

wiring,  or  timing  failure. 

Scenario:  A  launcher  mount  fails  to  hold  the  vehicle  on  rails  and  release  during  launch. 

•  Locking  mechanism  mechanical  failure 

•  Guide  assembly  failed  and  was  torn  from  launcher,  hitting  propeller 

•  Launch  strap  failed  on  two  vehicles 

•  Holdback  hook  released  early  before  launcher  was  ready 

•  Launcher  shuttle  did  not  release  vehicle  at  end  of  launch  stroke 

•  Aircraft  fell  off  launcher  when  attachment  failed 

•  Launcher  rails  became  misaligned  over  time 

Scenario:  The  RATO  components  fail  to  detach  from  the  vehicle  after  launch,  hindering 
tailhook  deployment  and  arrested  landing. 

There  was  one  mishap  in  which  this  scenario  occurred. 

4.2  Recovery  Systems 

Scenario:  Inadequate  design  of  a  ship  recovery  net  allows  a  UAV  to  hit  the  ship. 

•  Excess  net  runout  did  not  provide  sufficient  room  for  the  vehicle  to  decelerate  upon 
landing  before  hitting  the  ship  superstructure. 

•  The  recovery  net  design  specific  to  one  type  of  ship  was  used  on  a  different  ship  with 
different  landing  area  geometry.  These  differences  resulted  in  a  gap  in  the  net  that  the 
UAV  was  able  to  pass  through  on  recovery.  The  UAV  then  hit  the  ship. 

Scenario:  Maintenance  and  wear  on  the  arresting  gear  results  in  inadequate  performance. 

•  The  stakes  that  were  driven  into  the  ground  to  hold  the  arresting  gear  attachment  points  in 
place  at  a  remote  site  came  loose  over  time  and  broke  free  during  an  arrestment. 

•  The  incorrect  adjustment  of  the  arresting  gear  brake  drum  torque  resulted  in  excessive 
braking,  which  snapped  the  landing  vehicle’s  tailhook  rather  than  gradually  decelerating 
the  vehicle.  The  tailhook  popped  off  the  cable  and  the  vehicle  rolled  past  the  end  of  the 
runway. 

•  The  arresting  gear  restraining  straps  failed  due  to  deterioration  caused  by  exposure  to 
weather  and  repeated  use. 

•  An  unauthorized  field  repair  resulted  in  a  shorter  section  of  cable  available  to  catch  the 
vehicle’s  hook.  The  repaired  section  was  made  of  a  nylon  strap  rather  than  cable 
material.  A  vehicle  landing  near  the  edge  of  the  runway  ran  over  the  repaired  nylon  strap 
section  and  not  the  cable,  and  did  not  engage  the  cable. 
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Scenario:  Failures  of  the  automatic  landing  system  result  in  loss  or  damage  to  the  UAV.  There 
were  four  mishaps  with  two  different  vehicle  types  in  the  data. 

•  Incorrect  landing  parameters  were  entered  into  the  automatic  landing  system  control, 
which  resulted  in  an  approach  well  off  centerline.  The  vehicle  hit  an  obstacle  on  the  side 
of  the  runway. 

•  The  automatic  landing  system  transponder  failed  on  approach;  however,  the  failure  was 
not  recognized  on  preflight  or  during  approach.  The  review  board  recommended 
diagnostics  for  tactical  automatic  landing  system  (TALS). 

•  An  automatic  landing  system  transponder  lost  link  during  the  approach  just  prior  to 
touchdown.  The  vehicle  rolled  off  the  side  of  the  runway.  The  previous  vehicle  event 
had  experienced  a  TALS  warning  on  preflight.  The  mishap  summary  did  not  specify 
wind  limits  for  the  vehicle;  however,  there  was  a  large  headwind  shift  between  350  ft  and 
the  surface  from  40  knots  headwind  to  10  knots  at  the  surface,  which  may  have  been  out 
of  limits  ( see  Subsection  5.1.2). 

•  Careless  aircraft  maintenance  actions  resulted  in  water  getting  into  the  automatic  landing 
system  transponder  antenna  connection.  The  automatic  landing  system  became  unusable 
for  landing  and  the  vehicle  was  lost  at  sea. 

Scenario:  The  net  design  stops  the  vehicle,  but  causes  minor  damage. 

A  hazard  report  describes  multiple  occurrences  of  minor  damage  to  the  pitot  system  and 
antennas  as  a  result  of  engaging  the  runway  recovery  net. 

4.3  Airfield 

Scenario:  Unimproved  runway  surface  conditions  cause  the  tailhook  to  skip  over  the  arresting 
gear  cable. 

•  Embedded  stones  in  a  runway  caused  the  tailhook  to  bounce  over  the  arresting  cable. 

•  A  dry  lakebed  used  for  landing  had  ruts  from  vehicle  traffic  when  the  lakebed  was  still 
wet.  The  tailhook  hit  the  rut  prior  to  the  arresting  cable  and  did  not  catch  the  cable. 

•  The  disks  that  hold  the  arresting  cable  above  the  ground  sank  in  soft  sand  so  the  cable 
was  lying  on  the  ground.  The  vehicle  tailhook  passed  over  the  cable  without  catching  it. 

Scenario:  A  vehicle  is  damaged  when  it  hits  an  obstacle  near  or  on  the  runway. 

At  a  remote  site,  a  paved  road  was  being  used  as  a  landing  surface.  The  UAV  hit  a 
pothole  at  the  end  of  the  landing  surface  on  rollout  and  was  damaged. 

Scenario:  Lack  of  operational  ATC  radar  and  reduced  tower  situational  awareness  contributed  to 
a  collision. 

A  small  UAV  requested  recovery  clearance  from  Tower  control  and  received  clearance  to 
land  at  their  discretion.  The  UAV  intended  to  overfly  the  south  end  of  the  runway,  but  was 
advised  of  a  helicopter  conducting  a  hover  check  in  that  area.  The  UAV  operator  adjusted  his 
heading  to  cross  over  mid-field  but  did  not  update  Tower.  A  second  helicopter  was  cleared  for 
takeoff  and  cleared  to  cross  the  runway  at  mid-field.  The  UAV  struck  the  second  helicopter’s 
rotors  and  was  destroyed.  The  helicopter  was  able  to  make  a  controlled  landing  with  damage  to 
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its  rotor  tips.  The  airfield  was  designated  as  Class  G  (uncontrolled)  rather  than  Class  D  because 
the  ATC  radar  had  not  yet  been  checked  and  certified  (see  also  Section  7.1). 
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CHAPTER  5 
Environment 

The  environment,  both  natural  and  man-made,  can  cause  or  contribute  to  mishaps  in 
combination  with  other  failures  discussed  elsewhere  in  this  document  or  independently.  Figure 
5-1  shows  mishaps  grouped  as  natural  (weather  and  terrain)  or  man-made  (RF)  environmental 
conditions.  Figure  5-2  shows  the  number  and  percentage  of  environment-related  mishaps  by 
phase  of  flight. 
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Figure  5- 1 .  Taxonomy  of  Environment-Related  Mishaps 
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UAV  Mishap  Scenarios 
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Figure  5-2.  Distribution  of  Environment-Related  Mishaps 


5.1  Weather  Causes 

There  were  53  different  mishaps  in  our  sample  in  which  weather  was  a  primary  or 
significant  causal  factor,  affecting  many  different  types  of  vehicles. 


5.1.1  Thunderstorms 

Scenario:  A  vehicle  is  damaged  or  destroyed  due  to  proximity  to  thunderstorm(s). 

•  A  pilot  misjudged  the  distance  from  a  thunderstorm  boundary  and  inadvertently  flew  into 
it.  A  lightning  strike  or  static  discharge  caused  a  temporary  loss  of  DC  power  and 
subsequent  ability  to  control  the  control  surfaces.  The  vehicle  crashed. 

•  A  UAV  was  assigned  to  support  troops  on  the  ground  in  contact  with  the  enemy. 
Thunderstorms  were  forecast  to  be  present  in  the  area.  The  crew  turned  the  vehicle  away 
from  observed  cloud  build-ups.  The  vehicle  then  lost  satellite  link.  Post-flight  analysis 
determined  a  lightning  strike  as  causing  the  loss  of  communications  and  subsequent 
crash. 

•  A  vehicle  was  struck  by  lightning  and  damaged  in  flight,  but  was  able  to  RTB. 

•  After  departing  a  mission  area,  a  UAV  entered  a  storm  system  and  was  damaged  by 
turbulence,  icing,  and  a  lightning  strike.  Aileron  control  was  lost,  but  the  operator  was 
able  to  regain  limited  control  with  ruddervators.  The  vehicle  transited  back  towards  base 
and  it  was  determined  that  there  was  insufficient  control  for  a  safe  runway  landing.  The 
decision  was  made  to  intentionally  crash  in  the  sea. 

•  A  UAV  on  station  at  18,000  feet  mean  sea  level  (MSL)  experienced  deteriorating 
weather.  The  mission  commander  requested  a  new  location  and  tasking.  As  the  UAV 
was  transiting  to  the  new  location,  it  was  hit  by  lightning  or  experienced  electrostatic 
discharge,  went  lost  link,  and  departed  controlled  flight. 

•  After  the  on-station  mission  was  complete  and  during  RTB,  a  UAV  flew  through  snow, 
ice,  and  turbulence,  which  resulted  in  the  UAV  encountering  five  severe  downdrafts  and 
going  lost  link.  The  review  board  determined  that  the  operator  failed  to  assess  the 
weather  and  that  lost  link  was  due  to  lightning  strike. 
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5.1.2  Wind/T  urbulence 

Scenario:  Wind  gust  or  wind  shear  causes  vehicle  structural  failure. 

•  A  vehicle  encountered  a  sudden  crosswind  gust  that  exceeded  the  limits  of  the  IMU, 
which  failed,  causing  an  abrupt  yaw  followed  by  a  structural  failure  of  the  tail  boom, 
which  caused  the  vehicle  to  enter  a  flat  spin. 

•  A  wing  failure  on  a  high-altitude  long-endurance  experimental  vehicle  was  caused  by 
exposure  to  turbulence,  which  resulted  in  an  in-flight  break  up. 

Scenario:  Wind  shifts,  gusts,  or  downdrafts  at  the  landing  site  cause  a  landing  mishap. 

•  Wind  shear  or  microburst  phenomena  on  final  approach  resulted  in  sudden  high  sink  rate 
and  impact  with  the  ground  1500  feet  short  of  the  runway  threshold. 

•  Unreported  wind  shear  on  short  final  caused  a  vehicle  to  impact  the  runway  nose  gear 
first,  breaking  the  nose  strut. 

•  During  an  automated  landing,  the  vehicle  encountered  a  wind  shift  from  acceptable 
crosswind  to  tailwind.  The  shift  occurred  after  the  decision  point  for  waveoff.  The 
system  cut  the  engine  too  high  and  too  long  for  a  normal  approach  and  the  vehicle  landed 
past  the  arresting  wire.  The  vehicle  bounced  over  a  capture  net,  ran  off  the  runway,  and 
impacted  a  sign. 

•  Engine  cut  logic  causes  the  engine  to  shut  off  if  it  detects  landing  impact  (i.e.,  sudden  G- 
force  change  at  low  altitude).  A  sudden  wind  shift  on  final  approach  caused  the  engine 
cut  logic  to  trigger,  resulting  in  a  hard  landing. 

•  A  UAV  was  launched  in  marginal  winds  and  the  winds  increased,  as  was  forecast.  The 
UAV  experienced  wind  shear  on  approach.  Due  to  the  known  forecast,  decision  making 
was  a  main  factor  in  this  incident. 

•  A  vehicle  experienced  a  TALS  transponder  failure  and  overshot  the  runway  with  a  40- 
knot  headwind  at  350  ft.  The  wind  dropped  to  10  knots  at  the  surface,  which  was  out  of 
wind  limits  for  TALS  ( see  Section  4.2). 

5.1.3  Rain 

Scenario:  Flight  through  visible  moisture  (rain,  fog,  clouds)  and/or  water  intrusion  into  the 
vehicle  causes  an  avionics  failure. 

Flight  in  moderate  rain  resulted  in  lost  link  and  loss  of  vehicle  for  three  separate  mishaps 

involving  the  same  type  vehicle.  In  this  design,  the  avionics  bay  was  not  protected  from  rain 

intrusion. 

5.1.4  Ice  and  Hail 

Scenario:  Flight  in  hail  or  freezing  conditions  results  in  structural  or  engine  damage. 

•  The  vehicle  unexpectedly  encountered  hail.  The  operator  was  able  to  land  the  vehicle 
safely,  but  with  significant  engine  and  leading  edge  damage. 
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•  The  vehicle  ice  detector  indicated  that  the  UAV  had  encountered  icing  conditions  in 
flight.  The  crew  flew  the  vehicle  away  from  the  icing  conditions.  A  transmission  chip 
light  illuminated  during  RTB,  and  something  was  observed  falling  off  the  vehicle.  The 
vehicle  then  crashed  into  the  sea. 

Scenario:  Pitot  icing  results  in  loss  of  airspeed  reference. 

•  The  vehicle  encountered  icing  conditions;  however,  the  operator  did  not  turn  on  pitot 
heat.  The  pitot  system  became  blocked  by  ice,  and  the  vehicle  made  excessive  pitch 
changes  when  the  autopilot  tried  to  capture  the  airspeed.  The  abrupt  pitch  changes 
resulted  in  structural  breakup. 

•  On  return  from  a  mission,  the  operator  was  unable  to  avoid  flying  the  vehicle  through 
rain  showers  and  icing  conditions.  The  autopilot  was  engaged  in  airspeed  hold  mode. 

The  pitot  tube  became  clogged  with  ice  and  gave  indications  of  low  airspeed,  so  the 
vehicle  went  into  a  dive  to  increase  airspeed.  When  the  pilot  turned  pitot  heat  on,  the  ice 
abruptly  melted,  and  the  vehicle  suddenly  pitched  up  to  slow  the  airspeed.  With  the 
sudden  pitch  up,  the  vehicle  exceeded  a  structural  limit  and  departed  controlled  flight. 

Scenario:  Icing  conditions  cause  carburetor  failure,  resulting  in  loss  of  thrust. 

A  vehicle  encountered  icing  conditions  and  the  carburetor  iced  up,  possibly  due  to  failure 

of  the  heated  throttle  plate.  The  engine  shut  down  due  to  fuel  starvation  and  the  vehicle  was 

recovered  under  parachute. 

5.1.5  Temperature  Extremes 

Scenario:  Exposure  to  cold  temperature  (without  icing  conditions)  at  high  altitude  causes  engine 
failure  and  loss  of  thrust. 

•  There  were  two  mishaps  in  which  lubricating  oil  is  suspected  to  have  congealed  at  cold 
temperatures  at  high  altitude  in  flight.  This  is  thought  to  have  caused  oil  starvation  to  the 
engine  and  loss  of  thrust. 

•  During  a  high-altitude  test  flight,  an  O-ring  in  the  fuel  line  became  brittle,  allowing  air 
seepage  into  the  fuel  line,  which  caused  fuel  starvation  to  the  engine.  The  emergency 
battery  voltage  was  also  low  due  to  the  cold  temperature,  so  the  emergency  parachute  did 
not  deploy. 

Scenario:  Exposure  to  cold  temperatures  causes  avionics  failure,  resulting  in  loss  of  control. 

A  vehicle’s  circuit  board  cracked  during  exposure  to  cold  temperatures  at  high  altitude, 

which  resulted  in  loss  of  uplink  control. 

5.1.6  Dust  and  Sand 

Scenario:  Sand  or  dust  gets  into  engine  components,  causing  engine  damage  or  reduced  thrust. 

•  Sand  in  spark  plug  threads  created  a  path  for  compression  gases  to  escape  the  engine 
cylinder  chamber.  This  caused  the  spark  plug  to  melt  and  resulted  in  vehicle  loss  of 
thrust. 
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•  A  hazard  report  described  multiple  occurrences  of  minor  damage  to  engines  as  a  result  of 
sand  being  ingested  into  the  air  intake  and  exhaust  port,  mixing  with  engine  oil,  and 
having  the  effect  of  sandpaper  on  internal  engine  components. 

5.1.7  Night  and  Low-Visibility  Operations 

Scenario:  Low  visibility  results  in  loss  of  situational  awareness  by  EPs  during  landing, 
contributing  to  landing  mishaps. 

This  was  a  contributing  cause  for  six  mishaps  previously  discussed  in  sections  34,  3.5, 
and  3.6.  affecting  three  different  types  of  UAV  and  a  helicopter  air-taxi  near  collision  discussed 
in  Section  43. 

5.1.8  Bird  strike 

Scenario:  A  collision  between  a  bird  and  an  aircraft  that  is  in  flight  or  on  a  take-off  or  landing 
roll  can  be  a  significant  threat  to  aircraft  safety  and  lead  to  significant  damage  or  total 
loss  of  the  aircraft. 

There  were  two  mishaps  in  our  sample  in  which  a  bird  strike  caused  damage  to  a  vehicle, 
one  leading  to  the  loss  of  a  vehicle. 

•  A  bird  strike  blocked  a  pitot  tube  just  after  catapult  launch,  causing  the  vehicle  to  crash. 

•  One  UAV  experienced  a  bird  strike  that  resulted  in  minor  structural  damage.  The  UAV 
was  able  to  continue  flying,  and  landed  safely. 

5.2  Radio  Frequency  Environment 

The  RF  environment  can  adversely  affect  a  properly  functioning  UAV  and  pose  a  hazard. 

5.2.1  RF  Interference  with  Control  Links 

Scenario:  Interference  with  vehicle  or  system  control  links  results  in  an  unexpected  loss  of 
control. 

•  The  link  to  an  airborne  UAV  was  lost  when  maintenance  personnel  turned  on  the 
transmitter  of  another  UAV  undergoing  maintenance  on  the  ground. 

•  An  unknown  source  of  RF  interference  triggered  the  self-destruct  mechanism  of  an 
experimental  commercial  vehicle  during  a  test  flight. 

5.2.2  RF  Interference  with  Navigation  Sources 

Scenario:  Interference  with  navigation  signals  results  in  a  mishap. 

Jamming  of  GPS  signals  by  North  Korea  may  have  contributed  to  the  fatal  crash  of  a 
Schiebel  S-100  Camcopter  UAV  near  Incheon,  South  Korea,  on  May  10,  2012.  The  small 
helicopter  crashed  into  its  ground  control  van,  killing  a  Schiebel  engineer  and  injuring  the  two 
remote  pilots,  both  Koreans. 
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5.2.3  RF  Interference  with  Communication  Links  (e.g.,  ATC,  other  GCS,  etc.) 

Scenario:  Interference  with  communications  links  between  the  operator  and  ATC  or  handoff 
GCS  results  in  reduced  airspace  situational  awareness  or  loss  of  mission  effectiveness. 

No  mishaps  of  this  type  were  recorded. 

5.3  Terrain 

The  presence  of  terrain  on  or  near  the  flight  path  can  pose  a  hazard  to  UAV  operation. 

5.3.1  Controlled  Flight  into  Terrain 

Scenario:  Incorrect  operator  configuration  or  programming  results  in  controlled  flight  into 
terrain  (CFIT). 

•  A  UAV  required  the  landing  altitude  be  specified  prior  to  an  automated  landing.  The 
operator  skipped  this  step  in  the  checklist,  the  vehicle  used  a  default  landing  altitude,  and 
the  vehicle  flew  into  the  ground  during  a  recovery  attempt. 

•  A  UAV  impacted  terrain  during  a  practice  approach  for  autopilot  recovery  training;  the 
cause  was  not  specified. 

•  An  improperly  programmed  emergency  mission  caused  the  vehicle  to  impact  terrain  after 
link  was  lost. 

•  Inaccuracies  in  the  INS/GPS  navigation  system  resulted  in  a  glideslope  400  ft  below  the 
correct  glide  path.  Clouds  obscured  the  camera  view  of  the  surface,  and  the  vehicle 
impacted  the  ground  on  approach  to  the  runway. 

5.3.2  Terrain  Masking 

Scenario:  Flight  over  the  horizon  or  behind  high  terrain  results  in  an  unexpected  loss  of  the  RF 
control  link. 

•  Due  to  engine  performance,  a  UAV  was  flying  at  a  lower-than-expected  altitude  in 
mountainous  terrain,  contributing  to  intermittent  link  performance.  The  vehicle 
emergency  mission  had  inadvertently  been  erased  by  the  backup  GCS.  The  vehicle  lost 
link  as  it  descended  behind  a  mountain  range  and  was  not  recovered. 

•  On  a  training  mission,  the  crew  inadvertently  descended  behind  a  ridgeline  and  lost  link. 
Prior  to  losing  link,  the  crew  had  attempted  a  heading  change.  The  vehicle  properly  flew 
its  emergency  mission  and  emerged  from  behind  the  ridgeline,  which  allowed  the  GCS  to 
regain  control  of  the  vehicle  and  subsequently  command  the  previously  entered  heading 
change.  The  heading  change  directed  the  vehicle  toward  the  mountains.  The  crew 
attempted  to  change  the  heading  again,  but  did  not  turn  off  heading  hold  and  the  vehicle 
impacted  the  mountain. 
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CHAPTER  6 

Multiple  Sources  of  Control 

Enabling  multiple  sources  of  control  in  a  UAV  system  introduces  more  complexity  to  the 
system,  as  well  as  the  potential  for  increased  failures.  As  shown  in  Figure  6-1,  multiple  sources 
of  control  can  be  categorized  as  multiple  control  stations  monitoring  or  controlling  a  single 
vehicle,  a  single  control  station  controlling  multiple  vehicles,  or  an  independent  FTS  that 
operates  separately  from  the  control  station.  Figure  6-2  shows  the  number  and  percentage  of 
mishaps  related  to  multiple  sources  of  control  by  phase  of  flight. 


Figure  6-1.  Taxonomy  of  Multiple  Source  of  Control  Mishaps 
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Figure  6-2.  Distribution  of  Multiple  Source  of  Control  Mishaps 
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6.1  GCS-to-GCS  Handoff 

Scenario:  The  process  of  handing  off  control  from  one  GCS  to  another  contributes  to  loss  of  or 
damage  to  the  vehicle. 

•  In  preparation  for  a  GCS-to-GCS  handoff,  the  crew  advised  the  receiving  crew  via  chat 
that  one  attitude  source  was  not  working  correctly  and  should  not  be  used.  The  receiving 
crew  erroneously  thought  the  vehicle  would  automatically  deselect  a  failed  attitude 
source.  The  non-working  attitude  source  was  selected  and  the  vehicle  departed 
controlled  flight.  The  review  board  noted  that  the  mishap  pilot  had  disregarded  the  brief 
in  selecting  a  degraded  attitude  source,  but  also  noted  that  the  technical  manual  was  not 
consistent  with  programming  (automatic  switching  only  occurs  when  the  source  is 
inoperative,  not  when  it  is  merely  degraded). 

•  During  GCS-to-GCS  turnover,  the  receiving  GCS  did  not  follow  the  turnover  checklist 
and  inadvertently  set  the  vehicle  into  emergency  mode.  The  vehicle  unexpectedly 
deployed  the  parachute  and  was  damaged  on  landing.  There  was  no  direct 
communication  between  the  two  GCSs. 

•  Due  to  checklist  errors,  the  stability  augmentation  system  and  engine  ignition  were 
inadvertently  switched  to  “off’  during  GCS-to-GCS  handover.  Vehicle  control  was  lost 
and  it  departed  controlled  flight. 

•  A  vehicle  experienced  an  uncommanded  descent  upon  handoff  to  the  launch/recovery 
controller.  The  recovery  chute  was  deployed,  and  the  vehicle  was  recovered  from  the 
crash  location.  The  exact  cause  was  not  determined. 

•  A  vehicle  went  into  a  rapid  descent  on  handoff  to  the  launch/recovery  controller.  The 
turnover  occurred  at  low  altitude,  so  no  recovery  was  possible.  No  minimum  turnover 
altitude  had  been  established. 

•  A  vehicle  was  returning  to  base  on  battery  power  after  alternators  had  failed  in  flight. 

The  aircrew  had  turned  off  unnecessary  electrical  loads  (i.e.,  load  shedding)  in  an  effort 
to  preserve  battery  life.  When  the  launch/recovery  GCS  gained  control,  the  electrical 
loads  were  all  turned  back  on.  The  vehicle  ran  out  of  battery  power  on  approach  to 
landing  and  crashed. 

•  A  UAV  had  marginal  link  connectivity  and  reduced  engine  performance,  so  the  crew 
started  a  second  GCS  in  an  attempt  to  get  a  better  link.  The  second  GCS  took  control,  but 
inadvertently  erased  the  emergency  mission  and  changed  the  emergency  response  to 
“emergency  glide  mode.”  The  vehicle  lost  link  as  it  descended  behind  a  mountain  range 
and  was  not  recovered. 

•  The  UAV  launch  and  recovery  element  inadvertently  turned  on  electrical  loads  during 
lost  engine  recovery,  draining  battery  and  causing  loss  of  control. 

6.2  Shadowing  GCS 

Scenario:  A  shadowing  GCS  not  intended  to  be  in  control  inadvertently  takes  control,  resulting 
in  loss  or  damage  to  the  vehicle. 

During  taxi  to  takeoff,  the  GCS  noted  uncommanded  control  inputs  and  vehicle 
acceleration  without  corresponding  throttle  inputs.  A  shadowing  GCS,  which  had  been 
established  for  safety/backup  purposes,  had  inadvertently  left  its  transmitter  on  and  unknowingly 
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took  control  when  the  RF  transmitter  from  the  primary  GCS  was  shadowed  by  buildings.  The 
vehicle  crashed  into  a  fence. 

6.3  Single  GCS  or  Single  Crew  Controlling  Multiple  UAVs 

Scenario:  The  GCS  is  unable  to  monitor  and  control  multiple  UAVs  assigned  to  it  in  unexpected 
situations,  resulting  in  loss  of  control  of  at  least  one  vehicle. 

A  test  team  was  demonstrating  the  ability  of  a  single  GCS  to  control  two  UAVs.  The 
first  UAV  was  launched  and  climbed  to  a  holding  altitude,  where  it  was  to  orbit  at  its  lost-link 
rally  point  after  link  was  switched  to  the  second  UAV’s  frequency.  As  the  second  UAV  became 
airborne,  the  crew  realized  the  first  UAV’s  rally  point  location  was  incorrectly  set  600  miles 
away  (data  entry  error  by  10  degrees  of  latitude).  The  first  UAV  flew  beyond  RF  line  of  sight 
and  was  lost  before  the  test  team  could  re-acquire  link. 

6.4  Independent  Flight  Termination  Systems 

Scenario:  Inadvertent  or  incorrect  activation  of  the  independent  FTS  results  in  loss  of  or  damage 
to  the  vehicle. 

•  A  UAV  under  test  suddenly  rolled  and  went  into  an  inverted  flat  spin.  The  pilot 
commanded  the  FTS,  which  shuts  the  engine  down  and  deploys  a  parachute.  The 
parachute  separated  from  the  aircraft,  and  the  vehicle  spun  into  the  ground.  The  FTS 
procedures  were  not  well  documented,  and  required  the  operator  to  follow  a  specific 
sequence  to  shut  down  the  engine  first  and  only  then  deploy  the  parachute.  The 
parachute  risers  had  contacted  the  spinning  propeller  blades  and  were  cut. 

•  A  UAV  in  flight  and  under  test  received  an  FTS  arm-and-terminate  command  from 
another  range  performing  ground  tests  on  a  different  vehicle.  The  vehicle  was  lost. 

•  A  UAV  in  flight  and  under  test  was  configured  to  self-terminate  if  reception  from  a 
ground-based  FTS  transmitter  was  lost.  The  FTS  transmitter  momentarily  stopped 
transmitting,  and  the  vehicle  self-terminated. 

•  An  unmanned  prototype  of  a  tilt-rotor  UAV  crashed  during  tests.  According  to  its 
builder,  the  UAV,  which  can  hover  like  a  helicopter  or  fly  like  a  plane,  went  down  after 
an  unidentified  radio  signal  triggered  a  self-destruct  mechanism  that  shut  the  engine 
down. 

•  A  UAV  crashed  on  a  test  range  after  the  unintentional  FTS  activation.  The  UAV  was 
“damaged  beyond  repair  due  to  a  failure  of  the  flight-termination  ground  equipment, 
which  caused  the  aircraft’s  fail-safe  flight  termination  mode  to  activate.”6  The  automatic 
fail-safe  system  was  “designed  to  irreversibly  terminate  flight”7  so  that  the  vehicle  was 
not  able  to  leave  the  range. 


6  Graham  Warwick.  “Lockheed  confirms  P-175  Polecat  UAV  crash.”  Flight  Global.  March  20,  2007.  Retrieved 
13  October,  2015.  Available  at  https://www.flightglobal.com/news/articles/lockheed-confirms-p-175-polecat-uav- 
crash-2 12700/. 

7  Amy  Butler.  “Lockheed’s  Polecat  UCAV  Demonstrator  Crashes.”  Aviation  Week  &  Space  Technology.  (19 
March  2007.):44. 
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CHAPTER  7 

Aircraft  Separation 

One  model  of  airspace  management  describes  safety  control  as  three  layers  of  conflict 
management: 

(1)  Conflict  management  through  organization  of  airspace  (routes,  types  of  airspace,  etc.); 

(2)  Provisions  for  separation  within  the  organized  airspace;  and 

(3)  Collision  avoidance,  when  separation  provisions  have  been  compromised. 

Understanding  how  each  layer  of  conflict  management  has  failed  in  previous  UAV 
mishaps  and  hazardous  events  can  provide  a  basis  for  assessing  the  current  risk  management 
capability. 

Unsatisfactory  outcomes  when  conflict  management  fails  include: 

•  Midair  collision; 

•  Near  midair  collision  (NMAC); 

•  TCAS  alert; 

•  In  unassigned  airspace; 

•  Not  in  contact,  unknown  status,  possible  undirected  flight,  risk  unknown. 

As  shown  in  Figure  7-1,  aircraft  separation  conflicts  can  occur  while  the  UAV  is  on  the 
ground  (i.e.,  airfield)  or  during  flight  (i.e.,  airspace).  Figure  7-2  shows  the  number  and 
percentage  of  aircraft  separation  incidents  by  mishap  barrier  failure  category  and  phase  of  flight. 


Figure  7-1.  Taxonomy  of  Aircraft  Separation  Mishaps 
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Figure  7-2.  Distribution  of  Aircraft  Separation  Incidents 


7.1  Mishaps  Related  to  Airspace  Design  and  Procedure  Compliance 

Air  traffic  conflict  is  managed  in  part  by  the  design  and  implementation  of  flight  routes, 
types  of  airspace,  and  traffic  synchronization.  Safe  operation  is  maintained  by  flying  the  cleared 
flight  plan  and  staying  on  assigned  routes  and  in  assigned  areas. 

Scenario:  A  vehicle  system  malfunction  causes  the  vehicle  to  be  outside  of  its  assigned  airspace 
or  altitude,  causing  a  hazardous  situation. 

•  A  UAV  encountered  a  software  flaw  after  it  had  lost  link.  The  vehicle  did  not  engage  its 
emergency  mission,  but  instead  continued  on  a  heading  away  from  its  assigned  airspace 
and  towards  congested  airspace.  The  crew  was  able  to  regain  control  using  a  second 
GCS  to  regain  link. 

•  A  UAV  test  article  had  a  lost  uplink  failure  that  resulted  in  an  undirected  glide. 

•  Two  different  types  of  fixed-wing  UAVs  were  involved  in  a  near  miss  after  one  UAV 
had  a  ground  station  display  failure  that  eliminated  the  operator’s  position  awareness 
while  returning  to  base.  The  air  traffic  controller  on  duty  saw  the  vehicles  closing  and 
directed  them  apart. 


Scenario:  Activation  of  a  UAV’s  emergency  route  results  in  flight  outside  of  its  assigned 
airspace  or  altitude,  causing  a  hazardous  situation. 

•  A  UAV  at  9000  ft  MSL  lost  satellite  link.  The  programmed  emergency  mission  (lost-link 
mission)  directed  the  UAV  to  climb  to  regain  its  line-of-sight  link  and  then  descend  when 
link  is  re-established.  In  the  process  of  climbing  to  13,000  ft,  the  UAV  triggered  the 
TCAS  resolution  advisory  of  a  light  fixed-wing  aircraft  flying  above  it.  The  air  traffic 
controller  on  duty  was  able  to  advise  the  light  fixed-wing  of  the  UAV’s  position,  and  the 
aircraft  was  able  to  monitor  the  UAV’s  position  with  TCAS.  Analysis  suggests  the  UAV 
operator  mis-programmed  the  emergency  mission  altitude  climb  limit. 

•  A  GCS  experienced  a  rack  lockup,  requiring  a  reset  while  the  UAV  was  in  flight.  The 
crew  used  an  incorrect  restart  procedure  that  reset  aircraft  parameters,  resulting  in 
permanent  loss  of  link.  The  crew  did  not  have  the  most  up-to-date,  validated  GCS  rack 
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lockup  reset  checklist.  The  vehicle  followed  its  emergency  route  for  several  cycles  and 
eventually  crashed. 

•  While  controlling  two  UAVs  simultaneously,  a  test  team  intentionally  put  one  vehicle 
into  lost  link,  but  inadvertently  set  the  rally  point  600  miles  away  (data  entry  error  by  10 
degrees  of  latitude).  The  UAV  flew  beyond  RF  line  of  sight  before  the  test  team  could 
re-acquire  link.  The  UAV  violated  the  airspace  of  a  neighboring  country  before  crashing 
into  the  sea  on  the  other  side  (see  Section  6.3). 

Scenario:  A  vehicle  operator  error  or  violation  causes  the  vehicle  to  be  outside  of  its  assigned 
airspace  or  altitude,  causing  a  hazardous  situation. 

•  A  manned,  light  fixed-wing  aircraft  was  established  in  an  orbit  at  5000  ft  MSL  within  its 
ATC-assigned  operating  zone.  A  UAV  requested  and  received  clearance  to  RTB  at  5000 
ft,  but  was  advised  of  the  active  operating  zone  nearby.  The  UAV  operator 
acknowledged,  but  failed  to  adequately  monitor  the  UAV’s  position.  The  UAV  drifted 
into  the  operating  zone,  causing  a  TCAS  alert  on  the  manned  aircraft.  The  UAV  passed 
within  1 .4  NM  of  the  manned  aircraft  at  co-altitude. 

•  Three  UAVs  and  a  manned  aircraft  were  cleared  for  operations  within  an  operating  zone 
controlled  by  one  tactical  control  center.  The  vehicles  were  communicating  with  each 
other  using  voice  and  text-based  chat  circuits.  A  fourth  UAV  from  another  service  was 
operating  in  adjacent  airspace  and  was  being  controlled  by  a  control  center  belonging  to  a 
third  service.  One  UAV  within  the  operating  zone  requested  lower  airspace,  coordinated 
with  the  other  aircraft  within  the  operating  zone,  and  received  clearance  from  the 
corresponding  tactical  control  center.  The  UAV  descended  through  the  operating  zone 
into  the  adjacent  airspace,  co-altitude  with  the  UAV  in  that  area.  The  events  met  the 
criteria  for  an  NMAC  before  the  controllers  monitoring  the  adjacent  airspace  were  able  to 
separate  the  vehicles.  Neither  of  the  two  involved  vehicles  was  aware  of  the  other 
vehicle’s  position.  Because  the  two  involved  UAVs  belonged  to  different  services,  no 
real-time  position  information  was  available  between  the  two  platforms.  The  hazard 
investigator  concluded  the  descending  UAV  operator  lost  situational  awareness  and 
descended  without  approval  of  the  adjacent  airspace  control  center,  resulting  in  the 
NMAC.  Differing  modes  of  communication  (voice  vs.  chat)  resulted  in  the  different 
vehicle  operators  having  dissimilar  situational  awareness. 

•  On  three  occasions,  the  Warning  Area  monitoring  facility  observed  unauthorized  UAVs 
operating  within  Warning  Area  airspace. 

•  During  after-hours  test  preparation,  a  non-participant  helicopter,  assuming  the  airfield 
was  closed,  performed  several  practice  approaches.  The  test  team  was  able  to  notify  the 
helicopter  of  their  presence  by  flashing  the  UAV  lights,  which  caused  the  helicopter  to 
depart  the  airfield. 

Scenario:  An  error  in  airspace  design  causes  the  vehicle  to  be  outside  of  its  assigned  airspace  or 
altitude,  causing  a  hazardous  situation. 

•  A  UAV  was  cleared  to  fly  the  tower  pattern  within  tower  airspace.  A  manned  tactical 
aircraft  was  performing  a  tactical  maneuver  in  adjoining  range  airspace  (i.e.,  the  two 
aircraft  were  operating  in  separate  airspaces  that  share  a  common  border).  The  two 
aircraft  flew  within  300  ft  of  each  other  with  no  visual  contact  until  after  the  event.  The 
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manned  aircrew  violated  tower  airspace;  however,  the  text  and  chart  depicting  the 
airspace  boundary  was  ambiguous  and  confusing.  There  was  no  discussion  of  tower  or 
range  controllers’  roles  in  the  incident  report.  Inadequacy  of  see-and-avoid  capability 
was  discussed  with  a  recommendation  for  a  sense-and-avoid  capability  or  TCAS  in  the 
UAV.  Among  the  review  board’s  recommendations  were  to  fix  the  airspace 
documentation  and  establish  a  safety  buffer  between  airspaces. 

•  According  to  North  Atlantic  Treaty  Organization  (NATO)  Joint  Air  Power  Competence 
Center  in  2004,  there  have  been  at  least  three  collisions  between  NATO  helicopters  and 
UAVs  in  southwest  Asia  due  to  inadequate  airspace  procedures. 

Scenario:  Loss  of  all  contact  with  a  UAV  and  no  wreckage  found  indicates  the  vehicle  may  have 
caused  an  unrecognized  hazardous  airspace  situation  before  crashing. 

This  scenario  was  experienced  at  least  nine  times. 

•  Communications  link  modem  failure 

•  Unspecified  cause  (3) 

•  Lost  link  (2) 

•  Loss  of  satellite  link 

•  Engine  failure 

•  Electrical  system  (2) 

•  Weather 

•  Navigation  system  failure 


7.2  Aircraft  Separation  with  ATC 

Scenario:  Failure  of  ATC  to  recognize  or  take  action  with  a  potential  conflict  causes  a  potential 
for  a  hazardous  airspace  situation. 

•  A  small  passenger  jet  was  given  clearance  by  ATC  to  climb  to  cruise  altitude  on  its 
heading.  In  the  climb,  the  jet  received  a  TCAS  alert  and  spotted  a  UAV  near  its  flight 
path  and  in  a  turn.  The  passenger  jet  maneuvered  to  avoid  the  oncoming  UAV. 

•  A  UAV  was  at  32,000  ft  MSL  and  needed  to  cross  a  known  jet  route  in  order  to  RTB. 

The  squadron’s  standard  operating  procedure  for  crossing  jet  routes  involved  ATC 
monitoring,  scanning  the  jet  route  with  visual  sensors,  and  deconflicting  with  the  data 
link.  As  the  UAV  began  transiting  the  jet  route,  the  UAV  crew  observed  a  co-altitude 
Boeing  747  in  the  jet  route,  4  NM  away.  The  UAV  was  commanded  to  descend  to 
increase  separation.  No  traffic  calls  or  advisories  were  made  by  ATC.  The  hazard  report 
states  the  data  link  display  was  frozen  and  ATC  believed  the  UAV  was  at  a  different 
altitude. 

•  A  UAV  under  test  was  flying  at  7000  ft  MSL  with  an  accompanying  observation  aircraft. 
A  non-participating  general  aviation  aircraft  was  not  in  contact  with  ATC  and  started  to 
follow  the  UAV  and  its  chase.  The  air  traffic  controller  on  duty  advised  the  UAV  to 
descend  and  then  to  make  several  turns.  The  non-participant  aircraft  followed.  The  air 
traffic  controller  advised  “it  appears  the  aircraft  is  following  you”,  and  then  the  non¬ 
participant  departed  the  area. 
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•  A  civilian  airliner  on  approach  to  a  large  airport  was  involved  in  a  nose-to-nose,  near- 
miss  encounter  with  a  UAV  on  the  UAV’s  assigned  route.  The  two  aircraft  missed  each 
other  by  less  than  200  feet  and  wake  turbulence  from  the  airliner  caused  the  UAV  to 
depart  controlled  flight.  The  airliner  was  unaffected;  however,  the  UAV  crashed  in  a 
populated  area.  A  NATO  spokesman  attributed  the  incident  to  ATC  failure. 

•  Two  UAVs  from  different  units  were  operating  in  airspace  established  for  UAV 
exclusive  use.  Both  UAVs  established  mutual  deconfliction  procedures  through  internet 
relay  chat  (mIRC).  After  several  hours  on  station,  one  UAV  stopped  using  chat  for 
deconfliction.  The  vehicles  converged  to  a  point  of  300  ft  of  vertical  separation  and  1/2 
mile  horizontal  separation. 

•  Two  UAV  teams  completed  their  missions  in  separate  operating  areas  and  each  requested 
new  assignment  areas  via  their  control  and  reporting  center  (CRC).  The  flight  path  to 
their  separate  destinations  crossed,  and  the  vehicles  were  at  the  same  altitude.  The  CRC 
radar  was  only  working  intermittently  and  the  CRC  controllers  did  not  notice  the  conflict. 
One  of  the  UAVs  had  an  airspace  deconfliction  tool,  recognized  the  situation,  and  made 
an  altitude  change.  The  crew  then  contacted  the  CRC  and  the  other  UAV  using  mIRC.  It 
was  not  until  after  the  two  UAVs  passed  each  other  that  the  CRC  provided  new  transit 
altitude  instruction. 

•  A  UAV  was  returning  from  a  five-hour  mission  to  its  assigned  airfield  and  was  instructed 
by  ATC  to  report  when  established  at  a  10-mile  base  for  the  active  runway.  Two  minutes 
later,  a  manned  cargo  aircraft  was  at  seven  miles  on  approach  to  the  same  runway,  and 
was  instructed  to  report  5  miles  out.  At  5  miles,  the  cargo  aircraft  struck  the  UAV.  The 
cargo  aircraft’s  TCAS  did  not  provide  a  warning  even  though  the  UAV  had  a  functioning 
transponder.  The  cargo  plane  suffered  leading-edge  wing  damage  and  the  UAV  was 
destroyed.  The  review  board  noted  the  following  factors:  Communication  procedures  - 
the  UAV  was  on  a  UHF  frequency  and  the  cargo  plane  was  on  a  VHF  frequency,  so 
neither  pilot  heard  all  of  the  other's  transmissions;  there  was  no  local  ATC  radar  facility; 
the  tower  controller  did  not  follow  local  procedures  regarding  mixing  UAVs  and  manned 
aircraft;  the  tower  controller  was  newly  qualified  and  alone  in  the  tower;  the  manned 
aircraft’s  TCAS  did  not  provide  a  warning. 

•  A  UAV  operator  requested  a  climb  from  18,000  ft  to  19,000  ft  MSL  within  the  operations 
area  via  mIRC,  which  the  tactical  control  center  approved  also  via  chat.  The  approval 
went  unnoticed  and  the  UAV  remained  at  18,000  MSL  while  a  second  UAV  checked  in 
to  the  area  and  was  also  approved  to  operate  at  18,000  MSL.  When  the  tactical  control 
center  recognized  that  the  first  UAV  had  not  yet  climbed,  the  tactical  control  center 
deconflicted  the  two  UAVs  by  altitude  without  incident.  (Note:  the  UAVs  were  operating 
with  differing  airspace  deconfliction  software;  Falconview  vs.  Zeus.) 

Scenario:  Incorrect  or  inaccurate  ATC  action  causes  a  potential  for  a  hazardous  airspace 
situation. 

•  A  small  UAV  was  cleared  by  ATC  for  surveillance  of  an  air  base  boundary  at  400  ft 
above  ground  level  (AGL)  and  below.  A  King  Air  (manned)  aircraft  was  cleared  to  land 
on  the  airfield.  At  400  ft  AGL  and  1/2  mile  from  the  airfield,  the  King  Air  reported 
passing  within  200  ft  of  the  UAV.  Investigation  revealed  Tower  control  failed  to  advise 
the  landing  aircraft  that  the  UAV  was  operating  in  the  vicinity.  The  incident  is 
considered  a  mistake  on  the  part  of  the  tower  controller. 
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•  A  UAV  was  on  a  takeoff  roll  after  receiving  clearance  from  Tower  control.  At  the  other 
end  of  the  runway,  a  military  truck  crossed  the  runway  without  clearance.  The  tower 
controller  assessed  that  the  UAV  would  be  airborne  well  before  reaching  the  truck  and 
did  not  cancel  the  takeoff  clearance.  The  UAV  pilot  never  saw  the  truck  and  took  off 
safely  without  incident.  The  truck  driver  was  aware  crossing  the  runway  without 
clearance  was  unauthorized. 

•  A  UAV  was  orbiting  in  tactical  airspace  as  assigned  by  the  local  tactical  airspace 
controller.  The  UAV  crew  noticed  another  aircraft  nearby  (2  NM  and  co-altitude).  A 
query  to  the  controller  indicated  the  other  UAV  had  been  assigned  airspace  that 
overlapped  the  first  UAV’s.  Investigators  determined  the  airspace  controller’s  lack  of 
attention  to  detail  as  the  cause  of  overlapping  assignments. 

Scenario:  Unclear  or  misunderstood  ATC  guidance  causes  a  potential  for  a  hazardous  airspace 
situation. 

•  Two  UAVs  were  launched  in  sequence  from  the  same  runway.  Due  to  non-standard  and 
ambiguous  terminology  from  Tower  control,  the  first  UAV  turned  toward  the  other  UAV 
after  takeoff,  creating  potential  for  collision.  The  tower  controller  then  recognized  the 
potential  hazardous  situation  and  directed  the  first  UAV  to  a  specific  altitude  and 
heading.  The  UAVs  departed  the  tower  airspace  without  further  incident. 

•  Two  UAVs  were  operating  in  a  tower  pattern.  One  of  the  UAV  operators  misheard 
Tower  control  instructions  to  extend  before  turning  downwind.  The  UAV  turned  early 
rather  than  late  as  instructed,  reducing  separation  between  aircraft  to  within  500  ft.  The 
tower  controller  turned  his  attention  to  another  aircraft  that  was  cleared  for  takeoff  and 
did  not  monitor  the  pattern  visually.  Both  UAVs  continued  on  their  planned  missions 
without  further  incident. 

•  Two  UAVs  were  operating  in  the  tower  pattern.  One  UAV  used  non-standard 
terminology  to  request  an  orbit,  which  confused  the  tower  controller.  Both  UAVs  ended 
up  in  close  proximity  at  the  same  altitude. 

•  A  UAV  operator  was  cleared  to  taxi  behind  another  UAV  preparing  to  take  off.  After  the 
other  UAV  took  off,  the  first  UAV  was  directed  to  taxi  up  to  the  runway  and  hold  short. 
The  UAV  taxied  onto  the  active  runway  in  position  for  takeoff.  The  UAV  operator  failed 
to  read  back  the  proper  clearance,  and  the  tower  controller  failed  to  realize  the  UAV 
operator  had  not  read  back  the  proper  clearance.  The  controller  cleared  another  aircraft 
to  touch  and  go  on  the  same  runway  the  UAV  was  on.  Upon  hearing  the  other  aircraft 
was  cleared  for  a  touch-and-go,  the  UAV  operator  announced  they  were  also  on  the 
runway.  The  tower  controller  then  directed  the  aircraft  on  final  to  go  around.  The  UAV 
operator  on  the  runway  then  obtained  takeoff  clearance  and  departed  tower  airspace 
without  further  incident. 

•  A  small  UAV  requested  recovery  clearance  from  Tower  control  and  was  cleared  to  land 
at  their  discretion.  The  UAV  intended  to  overfly  the  south  end  of  the  runway  but  was 
advised  of  a  helicopter  conducting  a  hover  check  in  that  area.  The  UAV  operator 
adjusted  his  heading  to  cross  over  mid-field,  but  did  not  update  Tower.  A  second 
helicopter  was  cleared  to  take  off  and  cross  the  runway  at  mid  field.  The  UAV  struck  the 
helicopter  rotors  and  was  destroyed.  The  helicopter  was  able  to  make  a  controlled 
landing  with  damage  to  its  rotor  tips.  The  airfield  was  designated  as  Class  G 
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(uncontrolled)  rather  than  Class  D  because  the  ATC  radar  had  not  yet  been  checked  and 
certified. 

•  A  UAV  operating  in  a  local  pattern  was  instructed  by  Tower  control  to  extend  downwind 
in  order  to  increase  separation  with  another  UAV  also  in  the  pattern.  The  UAV  operator 
acknowledged,  and  the  tower  controller  turned  his  attention  to  a  third  UAV  preparing  to 
take  off.  The  first  UAV  turned  onto  final,  which  positioned  it  close  to  the  second  UAV  at 
the  same  altitude.  Tower  instructed  the  second  UAV  to  descend  in  order  to  increase 
separation  and  cancelled  the  third  UAV’s  takeoff  clearance.  One  factor  cited  was  that  the 
first  UAV’s  Falconview  program,  which  displays  aircraft  positions  in  the  ground  station, 
was  not  working,  which  reduced  the  UAV  operator’s  situational  awareness. 

•  A  UAV  was  operating  in  an  assigned  operating  zone,  as  cleared  via  radio  by  the  local 
terminal  controllers.  The  area  outside  the  operating  zone  was  controlled  by  a  tactical 
controlling  agency  via  mIRC.  The  UAV  contacted  the  terminal  controllers  and  verbally 
requested  descent  from  15,000  to  12,000  due  to  weather.  The  terminal  controllers 
directed  the  UAV  to  contact  the  tactical  controlling  agency  for  permission  to  descend 
outside  the  operating  zone.  On  a  separate  frequency,  terminal  controllers  cleared  a 
second  UAV  into  the  operating  zone  at  the  same  altitude.  The  first  UAV  noticed  the 
second  UAV  on  Falconview  and  was  able  to  deconflict. 

7.3  See  and  Avoid 

Scenario:  Inadequate  ability  of  a  UAV  to  see  and  avoid  results  in  an  unsafe  situation. 

A  fighter  aircraft  collided  with  a  large  UAV  while  both  were  in  a  landing  pattern.  Pattern 
procedures  had  been  established  as  a  right-turn  pattern  for  UAVs  and  left-turn  pattern  for 
manned  aircraft;  however,  the  manned  fighter  made  an  approach  to  the  inactive  runway,  which 
was  perpendicular  to  the  active  runway,  nose  high  with  limited  forward  visibility  and  did  not  see 
the  larger  UAV  ahead.  After  impact,  the  fighter  landed  safely  with  damage.  The  UAV  entered  a 
spin  and  landed  in  a  populated  area,  causing  extensive  burn  injuries  to  a  child. 

7.4  Airfield  Design  and  Procedure  Compliance 

Scenario:  A  UAV  failure  or  operator  error  causes  the  vehicle  to  travel  outside  the  approved  taxi 
route,  causing  a  hazardous  situation. 

•  A  UAV  was  commanded  to  taxi  for  takeoff  based  on  a  pre-programmed  mission  plan.  As 
it  taxied,  ground  chase  observed  the  vehicle  was  making  incorrect  turns  and  called  for 
engine  shutdown.  The  vehicle  was  towed  back  to  the  hangar  without  further  incident. 

The  investigation  found  that  an  incorrect  mission  plan  had  been  loaded. 

•  A  nervous  junior  UAV  operator  inadvertently  engaged  the  automatic  start  program  and 
did  not  know  how  to  stop  it.  The  vehicle  accelerated  across  the  airfield  ramp  until  it 
impacted  a  parked  transport  aircraft. 

•  An  operator  in  a  second  shadowing  ground  station  skipped  a  step  in  the  ground  station 
startup  checklist,  which  resulted  in  the  GCS  transmitter  being  turned  on.  This  resulted  in 
the  shadowing  GCS,  rather  than  the  controlling  GCS,  having  control  of  the  vehicle.  The 
vehicle  then  responded  to  the  second  GCS’s  current  settings,  accelerated  on  the  ground, 
departed  the  prepared  surface,  and  impacted  a  fence  (see  Section  6.2). 
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•  An  operator  inadvertently  selected  autopilot  pre-programmed  mode  rather  than  cooling 
fan.  The  vehicle  attempted  to  go  to  an  airborne  waypoint  while  taxiing  and  ran  off  the 
taxiway  surface,  hitting  a  runway  light  (also  relates  to  an  event  in  Section  3.1). 

7.5  Aircraft  Separation  with  Ground  Control  and  Tower 

Scenario:  Lack  of  ground  control  taking  action  to  deal  with  a  potential  conflict  causes  a 
hazardous  airfield  ground  situation. 

•  A  Security  Forces  vehicle  did  not  notice  a  taxiing  UAV  and  failed  to  properly  give  way, 
forcing  the  UAV  to  stop  30  ft  from  the  vehicle.  The  Security  Forces  vehicle  had  only  one 
radio  that  was  tuned  to  the  security  force  net  (standard  procedure  at  the  time)  rather  than 
the  airfield  ramp  net.  The  procedure  has  since  been  updated  to  require  a  second  radio 
with  airfield  ramp  net.  The  driver  was  also  retrained  and  recertified  for  airfield  driving. 

•  A  similar  event  occurred  when  another  Security  Forces  vehicle  did  not  realize  the  red 
light  approaching  belonged  to  a  UAV  and  turned  onto  the  taxiway,  forcing  the  UAV  to 
come  to  a  sudden  stop. 

•  A  painting  contractor  assigned  to  paint  lines  on  the  airfield  taxiway  lost  situational 
awareness  and  continued  onto  the  active  runway  while  a  UAV  was  on  approach.  The 
local  tower  was  able  to  contact  the  UAV  on  final  and  direct  it  to  go  around. 

•  Two  UAVs  collided  on  an  active  runway  in  what  was  described  as  a  “procedural” 
incident.  No  further  information  was  available  in  the  news  article  cited. 

Scenario:  Incorrect  or  incomplete  ground  control  guidance  causes  a  hazardous  airfield  ground 
situation. 

One  minute  after  a  tower  controller  cleared  a  UAV  for  takeoff,  the  ground  controller 
cleared  an  airfield  maintenance  vehicle  to  cross  the  active  runway  at  the  intersection.  The  UAV 
rotated  well  before  the  crossing  ground  vehicle.  The  investigation  board  felt  the  ground 
controller  was  potentially  task-saturated. 

Scenario:  Unclear  or  misunderstood  ground  control  guidance  causes  a  hazardous  airfield  ground 
situation. 

•  Thirty  seconds  after  a  host  nation  tower  controller  cleared  a  UAV  for  takeoff,  the  host 
nation  ground  controller,  in  local  language,  cleared  a  host  nation  airfield  support  vehicle 
onto  the  same  active  runway.  The  UAV  was  able  to  rotate  and  climb  out  before 
encountering  the  ground  vehicle,  but  came  within  approximately  150  feet  of  the  vehicle. 

•  After  landing,  a  UAV  was  proceeding  to  the  taxiway  at  the  end  of  the  active  runway 
while  a  second  UAV  was  cleared  to  taxi  for  takeoff  from  the  same  taxiway.  Ground 
control  had  attempted  to  stop  the  landing  UAV’s  taxi  three  times;  however,  the  landing 
UAV  was  still  in  the  process  of  changing  to  ground  control’s  frequency  when  the 
operator  noticed  the  second  UAV  in  front  of  them  from  the  nose-aligned  camera  display. 
The  landing  UAV  avoided  collision  by  turning  to  the  edge  of  the  runway. 

•  A  military  utility  vehicle  was  assigned  to  deliver  cargo  to  the  other  side  of  the  airfield. 
The  driver  contacted  the  tower  for  permission  to  cross  the  runway.  The  tower  controller 
instructed  the  truck  driver  to  hold  short  of  the  runway  for  a  UAV  on  final  approach  to  the 
runway;  however,  the  transmission  was  distorted.  The  driver  asked  the  control  tower  to 
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repeat  the  instructions,  which  the  driver  misunderstood  as  clear  to  proceed,  and  crossed 
the  active  runway.  Tower  directed  the  UAV  to  go  around  due  to  the  vehicle  on  the 
runway. 

•  A  foreign  control  tower  cleared  a  UAV  to  line  up  on  the  runway  prior  to  takeoff.  The 
UAV  operator  checked  both  ends  of  the  runway  and  observed  an  airliner  being  towed 
down  the  runway.  The  UAV  operator  notified  tower  of  the  towed  aircraft  and  maintained 
vehicle  position  on  the  taxiway  until  the  airliner  had  passed. 

•  A  foreign  civilian  control  tower  cleared  a  light  civil  aircraft  to  land,  do  a  1 80-degree  turn 
on  the  runway,  and  exit  to  the  civilian  ramp.  While  the  manned  aircraft  was  still  on  the 
runway,  the  Tower  controller  cleared  a  military  UAV  from  the  military  ramp  onto  the 
runway  into  position  and  hold.  The  UAV  crew  monitored  the  progress  of  the  manned 
aircraft  as  it  headed  towards  them  at  the  end  of  the  runway  and  observed  it  pass  the 
entrance  to  the  civilian  ramp.  The  tower  had  a  discussion  with  the  manned  aircraft  in 
French.  The  UAV  taxied  to  the  side  of  the  runway  to  make  room  for  the  manned  aircraft 
to  pass  on  the  runway.  The  UAV  was  then  cleared  for  takeoff  and  departed. 

7.6  Ground  See  and  Avoid 

Scenario:  The  reduced  ability  of  a  UAV  to  see  and  avoid  other  aircraft  on  the  ground  leads  to  a 
hazardous  situation. 

•  A  UAV  was  cleared  to  taxi  back  to  the  ramp  after  landing  at  the  same  time  that  a  single¬ 
seat  fighter  on  the  ramp  was  cleared  to  taxi  to  the  runway.  The  fighter  saw  the  UAV 
approaching  and  turning  towards  his  aircraft  and  called  a  warning  on  ground  frequency, 
which  prompted  the  UAV  operator  to  stop  the  vehicle  within  a  few  feet  of  hitting  the 
manned  aircraft.  The  UAV  did  not  see  the  fighter  on  the  ramp  until  after  the  turn. 

•  Two  teleoperated  UAVs  collided  on  the  ground  on  the  active  runway.  The  cause  of  the 
collision  was  not  described  in  the  news  report. 

•  A  teleoperated  UAV  taxiing  back  to  the  hangar  nearly  collided  with  an  F/A-18  taxiing  in 
the  other  direction.  Last-minute  maneuvering  by  the  manned  aircraft  prevented  the 
collision. 

•  An  airfield  has  servicing  vehicle  spots  for  aircraft  on  the  taxiway  near  the  end  of  the 
runway.  An  automated  UAV  was  preparing  for  launch  on  one  of  these  spots,  and  a 
manned  aircraft  was  being  serviced  on  another  nearby  spot.  After  servicing  the  manned 
aircraft,  its  service  truck  drove  in  front  of  the  UAV  just  as  the  UAV  began  taxiing.  The 
UAV  chase  vehicle  saw  the  service  truck  moving  and  blew  its  hom.  The  service  truck 
stopped  and  backed  up  to  its  original  position  out  of  the  UAVs  path. 

•  A  helicopter  air-taxied  close  to  a  UAV  that  was  taxiing  back  to  its  line  at  night  on  a  busy, 
overseas  airfield.  The  UAV  was  buffeted  sufficiently  enough  for  the  operator  to  notice 
the  movement  on  video.  There  was  no  damage  to  either  vehicle.  The  investigator 
determined  that  either  the  helicopter  pilot  misjudged  the  distance  as  he  overflew  the  UAV 
or  did  not  see  the  UAV  at  all. 

•  A  base  security  officer  drove  onto  the  taxiway  at  night  as  part  of  his  routine  patrol.  He 
observed  a  red  light  on  an  aircraft,  but  did  not  recognize  it  as  a  UAV,  and  continued  on 
patrol  towards  the  vehicle.  The  UAV  operator  saw  the  security  vehicle  and  stopped  on 
the  taxiway,  at  which  time  the  security  officer  did  a  U-turn  and  exited  the  taxiway.  The 
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UAV  continued  on  without  further  incident.  Poor  lighting  was  a  factor.  The  security 
officer  was  identified  and  corrective  training  was  provided. 
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APPENDIX  A 

Degraded  State  Definitions 


A.l  Introduction 

In  this  analysis,  by  convention,  a  mishap  scenario  occurs  when  a  vehicle  transitions  from 
normal  flight  to  loss  of  ability  to  maintain  controlled  flight.  The  types  of  mishap  scenarios  are 
categorized  and  described  in  the  main  taxonomy.  This  categorization  and  description  provides  a 
basis  for  reviewing  UAV  test  proposals.  Familiarity  with  a  collection  of  mishap  scenarios 
provides  the  following  benefits: 

•  Increases  likelihood  that  potential  for  a  similar  scenario  will  be  recognized  beforehand; 

•  Provides  a  basis  for  reviewing  the  adequacy  of  existing  safety  efforts; 

•  Provides  a  method  to  ensure  a  broad  review  of  hazards; 

•  Provides  a  knowledge  base  for  safety  personnel  in  training. 

Preventing  mishaps  in  design  and  test  is  primarily  the  responsibility  of  system  designers, 
system  safety,  and  the  test  team.  One  range  safety  strategy  is  to  review  the  mishap  prevention 
efforts  and  question  any  deficiencies. 

An  alternative  range  safety  strategy  is  to  focus  on  degraded  states  of  flight  and  ensure 
barriers  and  safeguards  exist  for  each  degraded  state  or  that  the  degraded  state  of  flight  will  not 
be  encountered  because  corresponding  prevention  measures  are  in  place  and  independently 
certified  by  airworthiness  personnel. 

This  appendix  categorizes  and  defines  degraded  states  of  flight  based  on  mishap  data. 
When  possible,  ICAO  standard  terminology8  is  used.  The  frequency  of  occurrence  and 
correlation  with  specific  mishap  scenarios  is  also  provided. 

A. 1.1  What  is  a  degraded  state? 

In  our  mishap  taxonomy  convention,  a  chain  of  events  results  in  a  mishap  scenario 
(UAV’s  loss  of  ability  to  continue  flying).  Once  that  ability  to  maintain  flight  is  compromised, 
the  vehicle  may  enter  into  a  sequence  of  degraded  flight  capability  states  leading  to  a  final 
mishap  consequence.  Figure  A-l  shows  the  timeline  of  a  mishap  scenario,  with  the  chain  of 
events  from  normal  flight  through  the  top-level  event,  degraded  state,  and  finally  end  state,  or 
mishap  consequence. 


8  International  Civil  Aviation  Organization/Commercial  Aviation  Safety  Team  Common  Taxonomy  Team.  Aviation 
Occurrence  Categories:  Definitions  and  Usage  Notes.  V.  4.6.  October  2013.  May  be  superseded  by  update. 
Retrieved  14  October  2015.  http://www.intlaviationstandards.org/Documents/OccurrenceCategoryDefinitions.pdf. 
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MISHAP  SCENARIO  TIMELINE 


Top  Level  Event 
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Depart  Controlled  Flight 

•  In  Flight  Breakup 
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•  In  flight  breakup 

•  Uncontrolled  crash 

•  Controlled  crash  /  FTS 

•  Not  all  inclusive 


Success  in 
reducing 
mishap  scenario 
severity 


Partial  success  in 
reducing  mishap 
scenario  severity 


No  success  in 
reducing  mishap 
scenario 
severity 


End  State  Examples: 

Vehicle  loss  or  damage. 
Property  damage. 

Death  or  injury, 

Midair,  NMAC,  airspace  risk, 
security  compromise, 
international  incident 


Figure  A-l.  Mishap  Scenario  Timeline 


A. 1.2  Why  are  we  concerned  with  degraded  states? 

Operational  definitions  of  the  degraded  states  allow  us  to  more  clearly  recognize  a  range 
vulnerability  or  an  actionable  risk  reduction  opportunity.  If  we  recognize  a  significant  risk,  we 
can  take  measures  to  limit  or  eliminate  exposure,  reduce  probability  of  occurrence,  or  reduce 
severity  of  the  outcome. 

A. 1.3  Why  are  the  degraded  state  definitions  arranged  this  way? 

These  definitions  are  grouped  by  phase  of  flight  (in  flight,  ground  operations,  takeoff,  and 
landing)  and  special  situations  (arrested  landing,  parachute  recovery,  effect  on  airspace)  that 
represent  distinct  problem  categories  from  the  perspective  of  the  test  range,  as  shown  in  Figure 
A-2.  Figure  A- 3  shows  the  distribution  of  degraded  states  by  category  and  phase  of  flight. 
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Degraded  States 
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Figure  A-2.  Taxonomy  of  UAV  Mishap  Degraded  States 
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Distribution  of  degraded  states 
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Figure  A-3.  Distribution  of  Degraded  States  by  Scenario  Category 


A.2  In-Flight  Degraded  States 

In-flight  degraded  states  are  those  degraded  states  and  events  primarily  associated  with  a 
mishap  scenario  that  begins  in  flight,  but  may  continue  though  the  landing  phase.  Figure  A-4 
shows  the  number  of  degraded  states  by  mishap  scenario  category  that  occurred  while  a  UAV 
was  in  flight. 
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In-flight  degraded  states 
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Figure  A-4.  Degraded  States  Occurring  During  In-Flight  Phase 


A. 2.1  Continued  Controlled  Flight  Despite  Damage 

The  vehicle  continues  flying  in  a  controlled  manner  after  minor  damage  or  system 
warning.  The  vehicle  is  damaged  or  experiences  a  system  failure  that  allows  it  to  maintain 
controlled  flight  temporarily,  making  RTB  possible.  Figure  A-5  shows  the  number  of  events  by 
mishap  scenario  category  in  which  a  UAV  entered  a  degraded  state,  but  was  able  to  continue 
controlled  flight. 
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Flight 

Landing 
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Figure  A-5.  Degraded  State  Mishaps  with  Continued  Controlled  Flight 
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The  following  mishap  scenarios  are  associated  with  the  continued  controlled  flight 
degraded  state. 

•  There  were  five  mishap  scenarios  involving  structural  damage  in  flight;  all  were  able  to 
RTB. 

o  Vibration  caused  an  engine  cover  to  break  loose,  damaging  the  propeller, 
o  Hail  damaged  the  leading  edge  of  the  wing  and  engine, 
o  A  vehicle  experienced  lightning  strike  damage, 
o  Minor  damage  occurred  from  a  bird  strike. 

o  A  vehicle  experienced  a  hard  landing  and  nose  gear  damage  on  landing,  but  regained 
flight.  The  crew  was  able  to  set  up  for  another  landing  on  the  runway,  which  resulted 
in  additional  damage  to  the  vehicle. 

•  There  were  four  mishaps  involving  loss  of  sufficient  precision  control  to  safely  land  the 
vehicle.  In  each  case,  the  loss-of-control  event  occurred  in  flight,  but  the  vehicle  was 
able  to  RTB  and  perform  a  landing  approach.  Significant  vehicle  damage  occurred 
during  landing. 

o  The  C-band  uplink  failed  and  landing  was  performed  using  satellite  link, 
o  Loss  of  GPS  caused  two  vehicles  to  be  damaged  on  landing. 

o  Icing  damage  reduced  controllability  of  a  vertical-takeoff  UAV.  It  was  able  to  return 
but  did  not  have  adequate  control  to  land  safely. 

•  Two  NMACs  resulted  in  no  damage  to  the  vehicles  involved  and  both  were  able  to  return 
safely  to  base. 

•  A  hazard  report  described  how  sand  and  dust  in  the  air  did  not  cause  any  crashes,  but  did 
cause  excessive  engine  wear. 

Operators  can  attempt  to  recover  the  vehicle  from  a  degraded  state  and  transition  to 
continue  controlled  flight  state.  Two  instances  of  near  midair  and  one  runway  overshoot 
occurrence  transitioned  to  the  continue  controlled  flight  state  and  were  recovered  safely. 

Degraded  states  can  transition  to  worse  situations.  Several  mishap  events  resulting  in 
continue  controlled  flight  states  have  degraded  further  into  one  instance  each  of  depart  controlled 
flight,  forced  landing,  runway  overshoot,  and  abnormal  runway  contact,  resulting  in  loss  of  or 
damage  to  the  vehicle. 

A. 2. 2  Continued  Controlled  Flight  with  Insufficient  Resources 

The  vehicle  is  currently  under  control,  but  flight-critical  resources  such  as  fuel, 
lubricating  oil,  battery  power  (for  electric  vehicles),  or  electrical  system  power  source  are 
insufficient  to  RTB. 

Examples: 

•  Fuel  planning,  fuel  leaks,  or  engine  performance  is  anticipated  to  cause  fuel  exhaustion  or 
fuel  starvation  before  RTB. 

•  Battery  failure  or  poor  battery  performance  may  reduce  time  remaining  in  controlled 
flight. 

•  The  operator  mistakenly  stops  electrical  power  load  shedding  and  drains  battery  power 
more  quickly,  resulting  in  loss  of  control  before  arrival  at  base. 

•  Lubrication  stores  may  be  inadequate  for  RTB  due  to  planning  error  or  leaks. 
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•  Continued  flight  due  to  crew  error  or  failure  to  recognize  situation  may  cause  vehicle 
loss. 

Figure  A-6  shows  the  number  of  incidents  of  controlled  flight  with  insufficient  resources 
by  mishap  category  and  phase  of  flight. 
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Figure  A-6.  Degraded  State  Mishaps  for  Continued  Flight  with 
Insufficient  Resources 


The  following  mishap  scenarios  are  associated  with  the  continued  controlled  flight  with 
insufficient  resources  degraded  state. 

•  Seven  mishaps  were  caused  when  loss  of  electrical  generator  power  or  voltage  regulator 
failure  caused  continued  flight  on  battery  power  only,  but  the  battery  was  not  sufficient  to 
return  to  a  safe  landing  site. 

•  Four  mishaps  were  caused  when  lubricating  oil  ran  out. 

•  Fuel  contamination  caused  a  vehicle’s  engine  to  fail  and  to  begin  to  lose  altitude  just  after 
launch.  It  was  recovered  by  parachute. 

The  continued  controlled  flight  with  insufficient  resources  state  has  gotten  worse  on  12 
occasions  to  the  following  degraded  states: 

•  Depart  controlled  flight  (2); 

•  Undirected  flight  (1); 

•  Uncontrolled  crash  (1); 

•  Runway  overshoot/undershoot  (2); 

•  Precautionary  landing  at  alternate  airfield  (2); 

•  Fail  to  engage  arresting  gear  (2); 

•  Parachute  fails  to  open  or  attempt  too  late  (2). 
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A. 2. 3  Controlled  Flight  into  Terrain 

This  category  only  applies  to  in-flight  collision  with  terrain,  water,  or  obstacle  that  occurs 
without  any  indication  of  loss  of  control.  Collision  with  an  object  on  takeoff  or  landing  is 
categorized  separately  (see  Section  3.1  and  Section  3.4)  consistent  with  ICAO  categorization. 
This  includes  collisions  with  objects  extending  above  the  surface  (towers,  trees,  cables,  etc.). 
Figure  A-7  shows  the  number  of  events  by  mishap  scenario  category  and  phase  of  flight  that 
result  in  CFIT. 
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Figure  A-7.  Controlled  Flight  into  Terrain  Mishaps 

The  CFIT  state  is  typically  the  last  event  of  a  mishap  sequence.  On  one  occasion  the 
parachute  was  deployed  but  failed  to  open. 

A. 2. 4  Depart  Controlled  Flight 

The  vehicle  is  no  longer  able  to  maintain  and  control  yaw,  pitch,  or  roll.  The  vehicle  may 
still  have  thrust.  The  final  outcomes  from  this  degraded  state  are  ground  impact,  in-flight 
breakup,  or  attempted  parachute  recovery.  Stalls  and  uncontrolled  climbs  in  flight  (i.e.,  after 
launch  and  initial  climb  out)  are  also  included.  Uncontrolled  climb,  stall,  and  loss  of  thrust  on 
takeoff  are  addressed  in  Section  A.4.  Figure  A- 8  shows  the  number  of  departure  from  controlled 
flight  mishaps  by  scenario  category  and  phase  of  flight. 
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Figure  A- 8.  Departure  from  Controlled  Flight  Mishaps 


Mishap  scenarios  exhibiting  the  depart  controlled  flight  state  have  degraded  further  on  10 
occasions: 

•  In-flight  breakup  (1); 

•  Transition  to  parachute  (2); 

•  Parachute  fails  to  open  (4); 

•  Parachute  attempt  too  late  (2); 

•  Runway  overshoot/undershoot  (1). 


A. 2. 5  Ditch/Forced  Landing  on  Non-Runway  Surface 

The  operator  is  unable  to  return  to  a  controlled  landing  at  an  airfield  and  is  forced  to 
attempt  landing  on  an  unprepared  surface  or  at  sea.  Figure  A-9  shows  the  number  of  mishaps 
resulting  in  a  forced  landing  or  ditch  on  a  non-runway  surface  by  scenario  category  and  phase  of 
flight. 
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Figure  A-9.  Ditch/Forced  Landing  on  Non-Runway  Surface  Mishaps 


A. 2. 6  Directed  Glide 

The  operator  (or  flight  control  computer)  is  able  to  direct  the  vehicle  heading  but  not 
maintain  altitude.  Some  control  is  maintained  over  yaw,  pitch,  and  roll.  Thrust  is  gone  or 
insufficient  to  maintain  altitude.  Figure  A- 10  shows  the  number  of  directed  glide  mishaps  by 
scenario  category  and  phase  of  flight. 
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Figure  A- 10.  Degraded  State  Mishaps  with  Direct  Glide 


The  directed  glide  state  has  degraded  further  on  33  occasions: 

•  Depart  controlled  flight  ( 1 ) ; 

•  Undirected  glide  (9); 

•  Transition  to  parachute  (3); 

•  Attempt  parachute  too  late  (1); 
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•  Ditch/forced  landing  (7); 

•  Intentional  crash  (5); 

•  Collide  with  obstacle  on  approach  (1); 

•  Runway  overshoot  /  undershoot  (3); 

•  Abnormal  runway  contact  (3). 


A. 2. 7  In-Flight  Breakup 

The  vehicle  comes  apart  into  multiple  pieces  after  material  failure  or  exceeding  operating 
limits.  Figure  A- 1 1  shows  the  number  of  in-flight  break-up  mishaps  by  scenario  category  and 
phase  of  flight. 
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Figure  A- 1 1 .  In-Flight  Break-Up  Mishaps 


The  in-flight  breakup  state  is  typically  the  last  event  of  a  mishap  sequence.  Parachute 
recovery  of  some  components  is  possible. 

A. 2. 8  In-Flight  Fire 

A  fire  that  is  not  the  result  of  impact  occurs  in  the  vehicle. 

There  were  three  events  where  the  degraded  state  can  be  characterized  as  an  in-flight  fire. 
The  in-flight  fires  were  due  to  flammable  fluids  encountering  an  ignition  source.  Two  events 
were  related  to  lubricating  oil  leaks  and  one  was  due  to  a  fuel  leak  in  an  engine  bay.  Figure  A- 12 
shows  the  number  of  in-flight  fire  mishap  scenarios. 
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Figure  A- 12.  Degraded  State  Mishaps  with  In-Flight  Fire 


The  in-flight  fire  state  has  degraded  further  on  three  occasions: 

•  Depart  controlled  flight  (2); 

•  Break  up  in  flight  (1). 


A. 2. 9  Intentional  Crash  or  FTS  Termination  in  Safe  Location 

If  a  vehicle  is  damaged  and  unable  to  RTB,  one  option  is  to  crash  in  a  known  safe 
(unpopulated)  location  while  the  operator  still  has  some  control.  Intentional  crash  has  also  been 
used  to  ensure  the  destruction  of  sensitive  equipment  when  the  vehicle  is  not  able  to  make  it  to 
friendly  territory. 

“Flight  termination”  means  to  intentionally  cause  the  vehicle  to  lose  thrust  and  lose  lift  in 
the  event  of  some  loss  of  control,  as  in  undirected  flight,  for  example. 

There  were  seven  mishaps  that  were  associated  with  either  intentional  crash  or  activation 
of  an  FTS.  Figure  A- 13  shows  the  number  of  FTS  or  intentional  crash  mishaps  by  scenario 
category  and  phase  of  flight. 
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Figure  A- 13.  Flight  Termination/Intentional  Crash  Mishaps 


A. 2. 10  Lost-link  routine 

The  vehicle  is  following  the  lost-link  routine  as  designed  or  the  emergency  routine 
mission  as  planned.  If  loss  of  link  is  unplanned,  the  operator  is  unable  to  redirect  the  vehicle  or 
modify  the  vehicle  configuration  as  necessary  to  adjust  to  a  changing  situation.  This  is  not  a 
degraded  state  if  lost  link  is  intended  as  part  of  the  mission. 

The  lost- link  state  has  degraded  further  on  10  occasions: 

•  Depart  controlled  flight  (2); 

•  Directed  glide  (1); 

•  Undirected  glide  (2); 

•  CFIT  (3); 

•  Transition  to  parachute  (1); 

•  Ditch/forced  landing  (1). 

Figure  A- 14  shows  the  number  of  lost-link  mishaps  by  scenario  category  and  phase  of 

flight. 
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Figure  A- 14.  Degraded  State  Mishaps  with  Lost  Link 


A. 2. 11  Transition  to  parachute  recovery  (not  in  recovery  area) 

An  unexpected  or  unplanned  transition  from  normal  flight  to  emergency  or  precautionary 
recovery  under  parachute  occurs.  Recovery  may  be  successful  or  unsuccessful.  Figure  A- 15 
shows  the  number  of  parachute  recovery  attempts  by  scenario  category  and  phase  of  flight. 
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Figure  A- 15.  Degraded  State  Mishaps  with  Transition  to  Attempted 

Parachute  Recovery 


A. 2. 12  Uncontrolled  Impact  with  Terrain 

This  degraded  state  occurs  with  any  in-flight  phase  mishap  involving  surface  impact  not 
otherwise  described  by  another  degraded  state.  Figure  A- 16  shows  the  number  of  mishaps  that 
ended  with  an  uncontrolled  impact  with  terrain  by  scenario  category  and  phase  of  flight. 
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Figure  A-16.  Uncontrolled  Impact  with  Terrain  Mishaps 


A. 2. 13  Undirected  Flight  (flyaway) 

The  vehicle  continues  to  maintain  powered  flight  but  is  not  responsive  to  operator 
commands.  Figure  A- 17  shows  the  number  of  mishaps  involving  an  undirected  flight  degraded 
state  by  scenario  category  and  phase  of  flight. 
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Figure  A- 17.  Degraded  State  Mishaps  with  Undirected  Flight 


The  undirected  flight  state  has  degraded  further  on  six  occasions: 

•  Undirected  glide  (1); 

•  CFIT  (2); 

•  Collision  with  obstacle  during  approach  (1); 

•  Leave  assigned  airspace  (2). 
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A. 2. 14  Undirected  Glide 

The  operator  (or  flight  control  computer)  is  not  able  to  direct  the  vehicle  heading  or 
maintain  altitude.  Inherent  dynamic  stability  of  the  vehicle  design  may  keep  the  vehicle  from 
departing  level  flight.  Thrust  is  gone  or  insufficient  to  maintain  altitude.  Figure  A- 18  shows  the 
number  of  mishaps  involving  an  undirected  glide  by  scenario  category  and  phase  of  flight. 
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Figure  A- 18.  Degraded  State  Mishaps  with  Undirected  Glide 


The  undirected  glide  state  typically  results  in  an  uncontrolled  crash.  Other  outcomes 
included: 

•  Lost-link  routine  (1); 

•  Runway  overshoot/undershoot  (1); 

•  Parachute  fails  to  open  (1). 

A.3  Airfield  Ground  Operation  Degraded  States 

Degraded  state  mishaps  can  also  occur  on  the  ground  during  takeoff/launch,  landing,  taxi, 
or  standstill.  Figure  A- 19  shows  the  number  of  airfield  ground  operations  degraded  state 
mishaps  by  scenario  category  and  phase  of  flight. 
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Figure  A- 19.  Number  of  Ground  Operations  Degraded  States  Encountered 

A. 3.1  Collision  with  Obstacle  During  Takeoff  or  Landing 

The  vehicle  collides  with  an  object  while  airborne,  in  controlled  flight,  after  takeoff,  or 
during  landing  approach.  This  includes  collisions  with  vegetation,  power  cables,  antennas,  ships, 
buildings,  etc.  Figure  A-20  shows  the  number  of  mishaps  in  which  collision  with  an  object  on 
takeoff  or  landing  caused  a  degraded  state  by  scenario  category. 
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Figure  A-20.  Object  Collision  Mishaps 

A. 3. 2  Ground  Collision  with  Obstacle 

The  vehicle  collides  with  a  stationary  object  while  taxiing  to  or  from  a  runway  in  use. 
This  includes  collisions  with  a  parked  aircraft,  person,  parked  ground  vehicle,  obstacle,  building, 
or  structure  while  on  the  taxiway  or  runway  surface. 
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There  was  one  instance  of  a  vehicle  inadvertently  being  sent  a  launch  command  instead 
of  shutdown  on  the  parking  ramp  and  driving  itself  into  a  parked  aircraft. 

A. 3. 3  Ground  Collision  with  Moving  Vehicle  or  Animal 

The  vehicle  collides  with  a  moving  object  while  taxiing  to  or  from  a  runway  in  use.  This 
includes  collisions  with  other  taxiing  aircraft,  moving  ground  vehicles,  or  animals. 

•  There  was  one  instance  of  UAV/UAV  collision  on  the  taxiway,  on  the  ground. 

•  There  was  one  near  collision  of  a  taxiing  UAV  and  a  manned  aircraft  holding  short 
waiting  to  access  the  taxiway. 

•  No  UAV  ground  collisions  with  animals  in  our  database  were  classified  as  mishaps. 
Further  review  may  indicate  collisions  with  animals  were  classified  as  hazards  that  we 
have  not  reviewed. 

A. 3. 4  Loss  of  Control  -  Ground 

Aircraft  control  is  lost  while  it  is  on  the  ground.  Figure  A-21  shows  the  number  of  loss- 
of-control  mishaps  that  occurred  while  the  UAV  was  on  the  ground  by  scenario  category  and 
phase  of  flight. 
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Figure  A-21.  Loss  of  Control  Mishaps  -  Ground 


A. 3. 5  Runway  Excursion 

The  vehicle  veers  off  or  overruns  the  runway  surface  during  takeoff  or  landing.  Figure 
A-22  shows  the  number  of  mishaps  due  to  runway  excursion  by  scenario  category  and  phase  of 
flight. 
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Figure  A-22.  Runway  Excursion  Mishaps 


A. 3. 6  Runway  Incursion 

An  unauthorized  aircraft,  vehicle,  or  person  is  in  the  protected  area  of  a  surface 
designated  for  the  landing  or  takeoff  of  aircraft. 

This  definition  is  based  on  ICAO  taxonomy  and  airline  experience.  There  were  no 
categorized  mishaps  of  this  type  in  our  sample,  although  one  instance  of  ground  UAV  collision 
may  have  been.  There  was  not  enough  information  in  the  news  report  to  verify  this  was  the 
result  of  a  runway  incursion.  Figure  A-23  shows  the  number  of  degraded  state  events  due  to 
runway  incursion  by  mishap  scenario  and  phase  of  flight.  While  no  categorized  mishaps  were  in 
our  data  set,  there  were  multiple  reports  that  addressed  this  degraded  state. 
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Figure  A-23.  Runway  Incursion  Degraded  State  Events 
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A. 3. 7  Stop  in  Place  on  Runway 

An  unpredicted  or  uncontrolled  vehicle  stop  occurs  on  a  runway  or  taxiway.  The  vehicle 
may  block  other  aircraft  from  launch  or  recovery. 

There  were  two  occurrences  of  note  that  resulted  in  hazard  reports  rather  than  mishap 
reports.  It  is  a  significant  issue  if  it  takes  a  long  time  to  clear  the  runway  for  use  by  other 
aircraft.  Figure  A-24  shows  the  number  of  runway /taxiway  hazards  due  to  a  vehicle  stop  in 
place  by  scenario  category  and  phase  of  flight. 
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Figure  A-24.  Stop  in  Place  on  Runway/Taxiway  Hazards 


A.4  Takeoff  Degraded  States 

The  vehicle  encounters  a  degraded  state  on  takeoff  or  launch.  Figure  A-25  shows  the 
number  of  mishaps  in  which  a  degraded  state  occurred  upon  takeoff  by  scenario  category. 
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Figure  A-25.  Number  of  Takeoff  Degraded  States  Encountered 
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A.4.1  Abnormal  Climbout 

Vehicle  launch  or  takeoff  does  not  result  in  altitude  increase  necessary  to  safely  depart 
from  the  airport  or  results  in  excessive  climb  and  stall.  Figure  A-26  shows  the  number  of 
mishaps  in  which  an  abnormal  climbout  on  takeoff  or  launch  occurred  by  scenario  category. 
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Figure  A-26.  Degraded  State  Mishaps  with  Abnormal  Climbout 

A.4.2  Unguided  Flight/Erratic  Flight  Path  on  Launch 

Vehicle  launch  or  takeoff  does  not  result  in  consistent  or  predicted  heading  necessary  to 
safely  depart  from  the  airport.  Figure  A-27  shows  the  number  of  mishaps  in  which  unguided  or 
erratic  flight  occurred  on  takeoff  or  launch  by  scenario  category. 
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Figure  A-27.  Degraded  State  Mishaps  with  Unguided/Erratic  Flight  on 

Launch 
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A.4.3  Launcher  Damages  Vehicle 

The  vehicle  is  damaged  on  launch  and  does  not  have  sufficient  thrust  to  climb  or  loses 
structure  necessary  to  maintain  lift  or  control.  Figure  A-28  shows  the  number  of  mishaps  in 
which  the  vehicle  launcher  causes  damage  to  the  UAV  on  launch  by  scenario  category. 
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Figure  A-28.  Degraded  State  Mishaps  with  Vehicle  Damage  from 

Launcher 


A.5  Landing  Degraded  States 

Landing  degraded  states  are  those  degraded  states  and  events  primarily  associated  with  a 
mishap  scenario  that  begins  during  landing  or  an  attempted  landing.  Figure  A-29  shows  the 
number  of  degraded  states  by  scenario  category  that  began  while  a  UAV  was  in  the  landing 
phase  of  flight.  The  resultant  mishap  may  have  occurred  in  any  phase  of  flight. 
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Figure  A-29.  Number  of  Landing  Degraded  States  Encountered 
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A. 5.1  Abnormal  Runway  Contact 

This  degraded  state  is  caused  by  a  vehicle  landing  (or  takeoff)  that  involves  abnormal 
runway  or  landing  surface  contact.  Figure  A-30  shows  the  number  of  events  in  which  abnormal 
runway  contact  caused  a  degraded  state  that  led  to  a  mishap.  Events  are  shown  by  scenario 
category  and  phase  of  flight  in  which  the  mishap  occurred. 
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Figure  A-30.  Degraded  State  Mishaps  with  Abnormal  Runway  Contact 


Examples  include: 

•  Hard/heavy  landings,  long/fast  landings,  off-centerline  landings,  crabbed  landings; 

•  Nose  wheel  first  touchdown,  tail  strikes,  wingtip  strikes; 

•  Gear-up  landings. 


A. 5. 2  Emergency  or  Precautionary  Landing  at  Alternate  Site 

A  landing  at  an  alternate  airfield  is  warranted  due  to  actual  or  concern  regarding  degraded 
vehicle  airworthiness. 

There  were  only  two  events  in  our  sample,  both  related  to  loss  of  engine  lubrication. 


A. 5. 3  Pilot-Induced  Oscillation 

Pilot-in-the-loop  oscillations  result  in  increasing  “porpoising”  in  the  pitch  axis. 
Frequently,  PIO  is  associated  with  abnormal  runway  contact  on  landing,  but  is  also  possible  on 
runway  takeoff.  Figure  A-31  shows  the  number  of  events  in  which  a  PIO  degraded  state 
occurred  that  led  to  a  mishap.  Events  are  shown  by  scenario  category  and  phase  of  flight. 
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Figure  A-31.  Degraded  State  Mishaps  with  Pilot-Induced  Oscillation 


A. 5. 4  Runway  Overshoot/Undershoot 

The  vehicle  touches  down  off  of  the  runway  or  helipad  surface  in  close  proximity  to  the 
runway.  Off-airport  emergency  landings  are  excluded  (ICAO  convention).  Figure  A-32  shows 
the  number  of  runway  overshoot  or  undershoot  degraded  state  mishaps  by  scenario  category  and 
phase  of  flight. 
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Figure  A-32.  Degraded  State  Mishaps  with  Runway 
Overshoot/Undershoot 


A. 5. 5  Arresting  Gear  Events 

The  UAV  attempts  an  arrested  landing  and  misses  or  engages  in  an  unsuccessful  manner. 
Figure  A- 3 3  shows  the  number  and  type  of  arresting  gear  degraded  states. 
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Figure  A-33.  Number  and  Type  of  Arresting  Gear  Degraded  States 

Encountered 

An  arrested  landing  failure  can  be  caused  by  a  vehicle  or  vehicle  system  failure,  an 
arresting  gear  failure,  the  environment,  or  a  combination  of  factors.  Figure  A-34  shows  the 
number  of  degraded  state  mishaps  with  arresting  gear  issues  by  scenario  category. 


Arresting  gear  issues 


Landing 


Number  of  mishaps  resulting  in  this  degraded  state 
by  category  and  phase  of  flight 


Figure  A-34.  Degraded  State  Mishaps  with  Arresting  Gear  Issues 


•  Miss  net/overshoot  arresting  gear:  The  vehicle  flies  over  the  arresting  cable  or  the 
arresting  net. 

•  Fail  to  engage  arresting  gear  or  net:  The  vehicle  passes  over  the  arresting  gear  but  does 
not  catch  the  cable. 

•  Fail  to  stop  vehicle:  The  arresting  gear  or  net  engages  but  fails  to  stop  the  vehicle. 
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•  Automatic  landing  system:  The  automatic  landing  system  is  inoperative  or  unavailable 
during  a  landing  approach. 

•  Damage  to  vehicle:  The  net  or  arresting  gear  damages  the  vehicle. 

A. 5. 6  Parachute  Recovery  Degraded  States 

A  parachute  recovery  is  attempted  and  fails  or  causes  a  mishap.  Failures  can  be  traced  to 
the  parachute  recovery  system,  operator  error,  or  external  factors.  Figure  A-35  shows  by 
scenario  category  and  phase  of  flight  the  number  of  attempted  parachute  recoveries  in  which  a 
failure  caused  a  degraded  state  and  led  to  a  mishap. 
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Figure  A-35.  Degraded  State  Mishaps  with  Parachute  Recovery  Issues 


Figure  A- 3 6  shows  the  number  and  type  of  parachute  degraded  states  that  led  to  a 
mishap. 
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Figure  A-36.  Number  and  Type  of  Parachute  Degraded  States  Encountered 

A  planned  parachute  recovery  is  not  successful  for  one  of  the  following  reasons: 

•  Parachute  fails  to  open; 

•  Parachute  attempt  too  late,  too  close  to  ground; 

•  Vehicle  drifts  into  obstacle  or  unsuitable  landing  area; 

•  Vehicle  suspended  in  unusual  or  non-level  attitude. 

Unplanned  or  unexpected  deployment  of  a  parachute  recovery  system  at  other  than  the 
intended  recovery  site  is  addressed  in  Section  2.3.3. 

A.6  Airspace  Operations  Degraded  States 

Airspace  operations  degraded  states  address  the  vehicle,  nearby  vehicles,  and  the  air 
traffic  controlling  authority. 

The  terms  AIRPROX  (air  proximity  issues),  Loss  of  Separation,  NMAC,  and  Midair 
Collision  are  used  by  ICAO.  They  also  track  TCAS  and  Airborne  Collision  Avoidance  System 
alerts. 

There  is  some  commonality  here  with  the  airspace  mishap  scenarios;  should  we  prevent 
the  mishap  (mishap  scenario  approach)  or  treat  the  outcome  (degraded  state  approach)?  Figure 
A-37  shows  the  number  and  type  of  airspace  degraded  states. 
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Figure  A-37.  Number  and  Type  of  Airspace  Degraded  States  Encountered 

A. 6.1  Unknown  Airspace  Status 

The  operator  and/or  ATC  is  no  longer  in  contact  with  the  vehicle.  Risk  is  increased  to 
other  participants  of  the  airspace  because  separation  is  no  longer  assured. 

Not  being  in  assigned  airspace  increases  risk  of  collision  with  other  aircraft  or  denies  the 
use  of  that  airspace  to  other  aircraft.  Figure  A-38  shows  by  mishap  scenario  category  the 
number  of  degraded  states  involving  unknown  airspace  status. 
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Figure  A-38.  Degraded  State  Mishaps  with  Unknown  Airspace  Status 


A. 6. 2  Foss  of  Airspace  Separation  Assurance 

The  vehicle  was  observed  to  be  violating  some  safety  provision  of  the  airspace  system, 
such  as  not  on  its  assigned  route  or  in  assigned  area,  but  did  not  come  close  enough  to  meet  near- 
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midair  criteria.  Figure  A-39  shows  by  mishap  scenario  and  category  of  flight  the  number  of 
events  in  which  airspace  separation  assurance  was  lost  during  UAV  operations. 
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Figure  A-39.  Degraded  State  Mishaps  with  Loss  of  Airspace  Separation 

Assurance 
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A. 6. 3  Near  Midair  Collision 

•  A  UAV  has  an  unexpected  encounter  in  proximity  with  another  aircraft. 

•  The  aircraft  flew  within  500  ft  of  each  other. 

•  The  aircrew  took  evasive  action  or  would  have  taken  action  if  circumstances  allowed. 

•  Aircraft  proximity  triggers  a  TCAS  resolution  advisory. 

Figure  A-40  shows  by  scenario  category  the  number  of  NMACs  that  occurred. 
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Figure  A-40.  Degraded  State  Mishaps  with  Near  Midair  Collision 
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A. 6. 4  Midair  Collision 

A  UAV  impacts  another  vehicle  in  flight,  resulting  in  damage  to  or  loss  of  one  or  both 
vehicles.  Figure  A-41  shows  by  scenario  category  the  number  of  midair  collision  mishaps. 
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Figure  A-41.  Midair  Collision  Mishaps 
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